Overview

overview

10

Static

static

10

2024-05-21...ia.exe

windows7-x64

9

2024-05-21...ia.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    37s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/05/2024, 05:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-21_6760a646ccabf290310401fac8cd7487_mafia.exe

  • Size

    3.5MB

  • MD5

    6760a646ccabf290310401fac8cd7487

  • SHA1

    0fbbde4c92b539a4786ef41405c5d0e8e2ab3a9a

  • SHA256

    6ffb5421cc49ad1692aa9b27095dac99c20cadda3afa4eeb47cc86aabb3b665c

  • SHA512

    fdf3c0f3e8f02a2558e7598ea93371cbd93a25633aa3f37f59d4066f26d1416764237a9d9d3e4aa067a318bc5826f067e82dd3ed0ac5d6661ed58d5844be97e7

  • SSDEEP

    49152:oZtaC9KtT114hKySSdvnxHDyARWVDO5EYRkB3ANkTTltJxVNV9WekXTxbZ4KAuYh:eT9KtT11R/ARWko3AMHzVNVVkXTtZ4lb

Score
9/10
persistence

Malware Config

Signatures

  • Detects executables packed with VMProtect. 5 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 16 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-21_6760a646ccabf290310401fac8cd7487_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-21_6760a646ccabf290310401fac8cd7487_mafia.exe"
    1⤵
      PID:508
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3748
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3184
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1844
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3944
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1068
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1392
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3340
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:844
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4416
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:2232
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4448
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1260
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4480
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4360
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3124
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4820
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1484
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1680
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3124
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:544
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:4848
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:1260
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:4236
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3600
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:3708
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:4652
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:3696
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3152
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:4132
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:4292
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:3508
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:528
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:3200
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4344
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:2456
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:5040
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:772
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:3424
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:2540
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:3824
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:3420
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:4596
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:544
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:2536
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:696
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:3600
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:4484
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3016
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:3656
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:2828
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:5112
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:1240
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:4180
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:4252
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:1392
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:1544
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:5020
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:3068
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:4008
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:3176
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:1028
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:4324
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:3384
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:3480
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:3084
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:1784
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                  1⤵
                                                                                                    PID:3192
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:884
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:3020
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                          PID:4128
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:4412
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                            1⤵
                                                                                                              PID:3084
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                              1⤵
                                                                                                                PID:4400
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:1392
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                  1⤵
                                                                                                                    PID:3116
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                    1⤵
                                                                                                                      PID:1200
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                        PID:4344
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                        1⤵
                                                                                                                          PID:3656
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                          1⤵
                                                                                                                            PID:2960
                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                            explorer.exe
                                                                                                                            1⤵
                                                                                                                              PID:5104
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                              1⤵
                                                                                                                                PID:3116
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                1⤵
                                                                                                                                  PID:1540
                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                  explorer.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:3172
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:3124
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      explorer.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:1004
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:4460
                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                          1⤵
                                                                                                                                            PID:2324
                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                            explorer.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:796

                                                                                                                                            Network

                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                                    Filesize

                                                                                                                                                    471B

                                                                                                                                                    MD5

                                                                                                                                                    cf94c140b8e861d5b8a579457f8e4c26

                                                                                                                                                    SHA1

                                                                                                                                                    972614473d6a8399f72403c6090ed50bcee1e56b

                                                                                                                                                    SHA256

                                                                                                                                                    2307783397917148817da0e40ad8afc4256a3a42230085eaebe512d815ced1fc

                                                                                                                                                    SHA512

                                                                                                                                                    696239223616e16d17775660d2e1ef97e4b536741a2cb406510d9de8e4090f6653c0e2fc8196bde76be527b02f2e362bad3b73ad37ac9b0168efaa3c80d90c05

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                                    Filesize

                                                                                                                                                    412B

                                                                                                                                                    MD5

                                                                                                                                                    8fbaa0754f5ac25f6f00db40805912ed

                                                                                                                                                    SHA1

                                                                                                                                                    762c4b26595d74866b66c537825732ba363b940e

                                                                                                                                                    SHA256

                                                                                                                                                    4ba212fe3733aa273243ec64761c81da0ad6993511e3bed92a12a77a858aba3d

                                                                                                                                                    SHA512

                                                                                                                                                    bcafe0cf949af0cf26da7da75ba5ca7da66b1b936be19e1857967e5e4a0f64d0c98f31c86169763ae7adc7d3d9c6a7a1e90c56a83c63b91245d0f3bbbc36b7d4

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    d6ee20d0e3c2bdbe4d3571c14195d71f

                                                                                                                                                    SHA1

                                                                                                                                                    f354f2971182968949af37c1646d2b0a0ff0e12e

                                                                                                                                                    SHA256

                                                                                                                                                    4354c7c2376aefdb5bd9f6e7590752e4813fc7b723f5953b45714ee02ae9ae14

                                                                                                                                                    SHA512

                                                                                                                                                    042000ff7128fb01b4d820bd2bbddb19575e9630bc824596e9fc54043b146fc9061ee5dfba8253cd98233dcf36ea31c098d1c2882e2b7bcf4eb9501175423c21

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
                                                                                                                                                    Filesize

                                                                                                                                                    36KB

                                                                                                                                                    MD5

                                                                                                                                                    0e2a09c8b94747fa78ec836b5711c0c0

                                                                                                                                                    SHA1

                                                                                                                                                    92495421ad887f27f53784c470884802797025ad

                                                                                                                                                    SHA256

                                                                                                                                                    0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                                                                                                    SHA512

                                                                                                                                                    61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133607477598017156.txt
                                                                                                                                                    Filesize

                                                                                                                                                    75KB

                                                                                                                                                    MD5

                                                                                                                                                    79ea60e4feeffe4483ba2d0ea61852fb

                                                                                                                                                    SHA1

                                                                                                                                                    7d5921a1b6240cc717ad4f4478bbcfc42f3af8e8

                                                                                                                                                    SHA256

                                                                                                                                                    1e85f6cd486b20682b1a6af9f34e7993a558f3b5dccd1e80a55178847e794923

                                                                                                                                                    SHA512

                                                                                                                                                    4d0866c2b63af9570fa20bca628a6e67b3704d7ab5a8a1311fb614f38b54444cc6630390092282f075751cae38000a17e4bf1cb992a8900b0c72965c0b24dbf4

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\92G8RFY9\microsoft.windows[1].xml
                                                                                                                                                    Filesize

                                                                                                                                                    97B

                                                                                                                                                    MD5

                                                                                                                                                    154014c190bcc3ee57ed7e94a2f5d4b9

                                                                                                                                                    SHA1

                                                                                                                                                    20848fea26d00af1a18c235031228444530ec9d4

                                                                                                                                                    SHA256

                                                                                                                                                    bcd046aa48862e2cc160ed1dc72283cfeeffce82c66d4aae555664ae3043ac53

                                                                                                                                                    SHA512

                                                                                                                                                    91c232d6bb42bebe9f998bae5e1a08d9ea0a8ed86ead98ab733fcf8170ecb100f3294ba378ac4b07ed7b8023760a20324145fcd3884d8848334de81a718d8be5

                                                                                                                                                    Download Submit

                                                                                                                                                  • memory/508-8-0x00000000006B0000-0x00000000008D0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    2.1MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/508-1075-0x00000000006B0000-0x00000000008D0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    2.1MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/508-295-0x00000000006B0000-0x00000000008D0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    2.1MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/508-771-0x00000000006B0000-0x00000000008D0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    2.1MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/508-475-0x00000000006B0000-0x00000000008D0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    2.1MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1260-182-0x000002100FA00000-0x000002100FB00000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1024KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1260-201-0x00000218118C0000-0x00000218118E0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1260-220-0x0000021811EE0000-0x0000021811F00000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1260-187-0x0000021811900000-0x0000021811920000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1260-183-0x000002100FA00000-0x000002100FB00000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1024KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1260-772-0x0000000001020000-0x0000000001021000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1680-516-0x00000213E7F20000-0x00000213E7F40000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1680-502-0x00000213E7B20000-0x00000213E7B40000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1680-484-0x00000213E7B60000-0x00000213E7B80000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1680-479-0x00000213E6A00000-0x00000213E6B00000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1024KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2232-188-0x0000000004210000-0x0000000004211000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3124-622-0x0000000004040000-0x0000000004041000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3124-331-0x000001A7BD320000-0x000001A7BD420000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1024KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3124-335-0x000001A7BE480000-0x000001A7BE4A0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3124-362-0x000001A7BE850000-0x000001A7BE870000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3124-345-0x000001A7BE440000-0x000001A7BE460000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3124-330-0x000001A7BD320000-0x000001A7BD420000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1024KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3152-1077-0x0000000004070000-0x0000000004071000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3200-1264-0x0000025594350000-0x0000025594370000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3200-1233-0x0000025594390000-0x00000255943B0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3200-1229-0x0000025593240000-0x0000025593340000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1024KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3200-1228-0x0000025593240000-0x0000025593340000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1024KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3340-11-0x0000000003F80000-0x0000000003F81000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3508-1227-0x0000000004B90000-0x0000000004B91000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3600-780-0x000001A19A4C0000-0x000001A19A4E0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3600-797-0x000001A19AAA0000-0x000001A19AAC0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3600-787-0x000001A19A480000-0x000001A19A4A0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3696-961-0x000001EB62B00000-0x000001EB62B20000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3696-926-0x000001EB61A00000-0x000001EB61B00000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1024KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3696-927-0x000001EB61A00000-0x000001EB61B00000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1024KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3696-928-0x000001EB61A00000-0x000001EB61B00000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1024KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3696-931-0x000001EB62B40000-0x000001EB62B60000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3696-962-0x000001EB62F00000-0x000001EB62F20000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3708-924-0x0000000004D90000-0x0000000004D91000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4292-1084-0x0000025117CC0000-0x0000025117CE0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4292-1079-0x0000025116D60000-0x0000025116E60000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1024KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4292-1105-0x0000025117C80000-0x0000025117CA0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4292-1115-0x00000251182A0000-0x00000251182C0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4292-1080-0x0000025116D60000-0x0000025116E60000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1024KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4416-27-0x000001C30E420000-0x000001C30E440000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4416-43-0x000001C30E820000-0x000001C30E840000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4416-12-0x000001C30D100000-0x000001C30D200000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1024KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4416-17-0x000001C30E460000-0x000001C30E480000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4480-328-0x00000000041F0000-0x00000000041F1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4820-477-0x0000000003390000-0x0000000003391000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4848-640-0x0000020CB9940000-0x0000020CB9960000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4848-624-0x0000020CB8760000-0x0000020CB8860000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1024KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4848-625-0x0000020CB8760000-0x0000020CB8860000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1024KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4848-630-0x0000020CB9980000-0x0000020CB99A0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4848-651-0x0000020CB9D50000-0x0000020CB9D70000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    128KB

                                                                                                                                                    Download