Analysis

  • max time kernel
    64s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 18:11

General

  • Target

    Stningsstrukturers.ps1

  • Size

    58KB

  • MD5

    dd200d8c3c09458738a4ee7d421a891b

  • SHA1

    5821db55a8a2e95c67411c18893530d9c3cd47c6

  • SHA256

    0e5ad13c4627a6fcb258cbcf2e67bde5ac0f66b8e85291ba05dacc5021eeb4df

  • SHA512

    a2faef0cb547f0ee91ca5b45893300fc18943d1389f593bf2b58f557d8e85f7346e55be8a592c87e6e32dc98f9d568a05e59cc7d93b9288391c0465b6a68f39d

  • SSDEEP

    1536:sWQH2/5I3Msf3ZYyEkBsrTX+SKmiXY81ruyMmWKYgZVYJ:sWi65tOJ7EkW+SCDrZ9Ycs

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 13 IoCs
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Stningsstrukturers.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
      2⤵
        PID:1504
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4548
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1392
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4988
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3752
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3124
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SendNotifyMessage
      PID:4332
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:5072
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3132
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:3656
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2876
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3980
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3396
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3152
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4340
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3904
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4132
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1964
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:2200
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4816
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2016
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4336
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3104
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1784
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4872
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3420
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1736
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4076
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2480
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1564
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:212
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3544
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3116
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:2792
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4132
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3848
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      PID:4340
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:3292
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:2780
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:1388
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:2952
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:404
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:1948
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:4220
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3860
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:2156
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:2848
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:3740
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:4688
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:4184
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:4300
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:3788
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:2200
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:2140
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:1060
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:4208
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:2756
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:3200
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:3104
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:4636
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:3644
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:3044
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:2636
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:2280
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:5112
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:3688
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:1688
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:3108
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:3200
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:3564
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:1780
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:2652
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:2160
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:1060
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:3688
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:1364
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:3432
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:3256
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                        1⤵
                                                                                          PID:2140
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:3020
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:2328
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:3748
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:3296
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                  1⤵
                                                                                                    PID:412
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:5072
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:3200

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                        Filesize

                                                                                                        471B

                                                                                                        MD5

                                                                                                        45654e26b54abaef678dbdb46a9eb535

                                                                                                        SHA1

                                                                                                        a23cc33fe546ee53bdb07589548d84c2101d6ab0

                                                                                                        SHA256

                                                                                                        329924597f143dd23c32377fbcbde16a057c28500ff47149dfc4768df5853030

                                                                                                        SHA512

                                                                                                        313a7c6066b6be2cad54272cab1931fdf6f42b68c3ee78fd06eb4f4574df788a2e9892be74bed3f6198aab652fa3dcf36ccfff9f777d62d3c1d51acd0cff7f9b

                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                        Filesize

                                                                                                        412B

                                                                                                        MD5

                                                                                                        f0a27ff559591d8c5eb1cb295b81ead0

                                                                                                        SHA1

                                                                                                        d347fa2dd38fa3457ba248d3f4c496a2a4e4b8c0

                                                                                                        SHA256

                                                                                                        c8cdb5e86aaafef2239f100bc08ce0c412a4abefed7b62853f477c9c797918c0

                                                                                                        SHA512

                                                                                                        f309a8e7dc6df316f10400aaa4a05e92466bd66bf68c0621a74a55d9930155311f214ea976486f402e6a7e0e7015d9fb26f57ab4ebe3415057b502408f88e006

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        f33e65509797aa78923973fdbbffc33f

                                                                                                        SHA1

                                                                                                        b1fbc77f8f71d56d16e7a4e4a2d1f54a660332dc

                                                                                                        SHA256

                                                                                                        b99319fd52758bba17a6d98e5692220cd094d4fbccdb7e73d595a5838950e4c3

                                                                                                        SHA512

                                                                                                        843bc3b0e03d41eff2735307f5ef6c0516d1170d872984a863c435cd88b40e48e9a1e78e384f4716534da6c5dfaaaa299b9f2948f0f39c1169cb41ffa4a9a26c

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15

                                                                                                        Filesize

                                                                                                        36KB

                                                                                                        MD5

                                                                                                        0e2a09c8b94747fa78ec836b5711c0c0

                                                                                                        SHA1

                                                                                                        92495421ad887f27f53784c470884802797025ad

                                                                                                        SHA256

                                                                                                        0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                                                        SHA512

                                                                                                        61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer

                                                                                                        Filesize

                                                                                                        36KB

                                                                                                        MD5

                                                                                                        ab0262f72142aab53d5402e6d0cb5d24

                                                                                                        SHA1

                                                                                                        eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                                                        SHA256

                                                                                                        20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                                                        SHA512

                                                                                                        bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133608750856470938.txt

                                                                                                        Filesize

                                                                                                        75KB

                                                                                                        MD5

                                                                                                        8cdd0e31fdc880d03dd47abc4b0efbf9

                                                                                                        SHA1

                                                                                                        37648604549b090bc8683dffda89fe8338b18d9c

                                                                                                        SHA256

                                                                                                        edf5f36d377aa149ebfbf55c896fe8716ea11f49a9ec61df2d327bc43c835bab

                                                                                                        SHA512

                                                                                                        b7cb49eb50e7b5e0d36c7e971b39bde726d36383f5723ad5bb082c266435550030d5a8b53eda5c2ddfc720d73007aba4ffd36b32949161876104328d98a9a511

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\3MKUANJA\microsoft.windows[1].xml

                                                                                                        Filesize

                                                                                                        97B

                                                                                                        MD5

                                                                                                        6a517bf11dbd236d703ed9898dd3f910

                                                                                                        SHA1

                                                                                                        f8d64563b0eaba616dc29496c51f795ede02d767

                                                                                                        SHA256

                                                                                                        d7b7aa87d942a062dd03f78ade8fab7d8efcba60b8c44c52326eea574eeb182b

                                                                                                        SHA512

                                                                                                        04f15407222285b97dfff27db7320a590d20c7982d13e2eabc68d3b99fce2863951de8321780e7e70d0d187297c6ee6202014dc0ac6d30a7010bff59be769058

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\3MKUANJA\microsoft.windows[1].xml

                                                                                                        Filesize

                                                                                                        191B

                                                                                                        MD5

                                                                                                        994227f1c2ea833918e29d68efaa57d5

                                                                                                        SHA1

                                                                                                        f0a43176306c01f7a8b8630f2503e82c1c3f3afa

                                                                                                        SHA256

                                                                                                        9dfcafa84feed9460db91d032dd099908ce8a6e324fa0c7af580a75ceac5463b

                                                                                                        SHA512

                                                                                                        79ece95620adfccffabacf9e10091913452638f804e7157d4eb5521dd1ac7a9172df164327199b5afc33c41ab23b728a6553c2bdcecb7b08374d588688fbb540

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ni0bbyj1.tvd.ps1

                                                                                                        Filesize

                                                                                                        60B

                                                                                                        MD5

                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                        SHA1

                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                        SHA256

                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                        SHA512

                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                      • memory/212-1390-0x00000000046F0000-0x00000000046F1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/1076-17-0x00007FFFD8E40000-0x00007FFFD9901000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/1076-12-0x00007FFFD8E40000-0x00007FFFD9901000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/1076-16-0x00007FFFD8E40000-0x00007FFFD9901000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/1076-14-0x00007FFFD8E40000-0x00007FFFD9901000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/1076-13-0x00007FFFD8E40000-0x00007FFFD9901000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/1076-1-0x0000028863240000-0x0000028863262000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/1076-0-0x00007FFFD8E43000-0x00007FFFD8E45000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/1076-11-0x00007FFFD8E40000-0x00007FFFD9901000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/1076-18-0x00007FFFD8E40000-0x00007FFFD9901000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/1564-1241-0x000002C10F050000-0x000002C10F150000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/1564-1240-0x000002C10F050000-0x000002C10F150000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/1564-1245-0x000002C1101B0000-0x000002C1101D0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1564-1266-0x000002C110580000-0x000002C1105A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1564-1254-0x000002C110170000-0x000002C110190000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1736-1120-0x0000017BDA500000-0x0000017BDA520000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1736-1096-0x0000017BD9F20000-0x0000017BD9F40000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1736-1092-0x0000017BD9000000-0x0000017BD9100000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/1736-1091-0x0000017BD9000000-0x0000017BD9100000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/1736-1109-0x0000017BD9EE0000-0x0000017BD9F00000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1784-963-0x0000021B8D640000-0x0000021B8D660000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1784-980-0x0000021B8DA50000-0x0000021B8DA70000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1784-949-0x0000021B8D680000-0x0000021B8D6A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1964-647-0x00000278B2D40000-0x00000278B2D60000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1964-660-0x00000278B2D00000-0x00000278B2D20000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1964-679-0x00000278B3110000-0x00000278B3130000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2016-799-0x0000020457770000-0x0000020457790000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2016-823-0x0000020457B40000-0x0000020457B60000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2016-811-0x0000020457730000-0x0000020457750000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2016-796-0x0000020456620000-0x0000020456720000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/2016-794-0x0000020456620000-0x0000020456720000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/2200-792-0x00000000049A0000-0x00000000049A1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2780-1685-0x000001E37ED00000-0x000001E37EE00000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/2792-1535-0x0000000004490000-0x0000000004491000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3116-1397-0x0000024DA0560000-0x0000024DA0580000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3116-1405-0x0000024DA0520000-0x0000024DA0540000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3116-1418-0x0000024DA0930000-0x0000024DA0950000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3124-63-0x0000021B038C0000-0x0000021B038E0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3124-28-0x0000021B02500000-0x0000021B02600000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/3124-42-0x0000021B02FA0000-0x0000021B02FC0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3124-33-0x0000021B02FE0000-0x0000021B03000000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3132-193-0x00000279B4000000-0x00000279B4100000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/3132-194-0x00000279B4000000-0x00000279B4100000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/3132-198-0x00000279B4F10000-0x00000279B4F30000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3132-225-0x00000279B54E0000-0x00000279B5500000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3132-210-0x00000279B4ED0000-0x00000279B4EF0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3396-491-0x0000000004150000-0x0000000004151000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3656-344-0x0000000003E80000-0x0000000003E81000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3848-1564-0x00000289AA5A0000-0x00000289AA5C0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3848-1551-0x00000289AA190000-0x00000289AA1B0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3848-1543-0x00000289AA1D0000-0x00000289AA1F0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3904-640-0x00000000040C0000-0x00000000040C1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3980-352-0x0000025045C20000-0x0000025045C40000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3980-382-0x0000025045FE0000-0x0000025046000000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3980-369-0x00000250459D0000-0x00000250459F0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4076-1238-0x0000000004750000-0x0000000004751000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/4332-191-0x0000000004090000-0x0000000004091000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/4336-941-0x00000000045B0000-0x00000000045B1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/4340-508-0x000001A7E6F20000-0x000001A7E6F40000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4340-498-0x000001A7E6F60000-0x000001A7E6F80000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4340-1684-0x0000000004B30000-0x0000000004B31000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/4340-521-0x000001A7E7330000-0x000001A7E7350000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4340-493-0x000001A7E5E00000-0x000001A7E5F00000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/4872-1089-0x0000000004830000-0x0000000004831000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/4988-27-0x00000000044E0000-0x00000000044E1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB