Overview

overview

10

Static

static

1

BoxDrive.msi

windows7-x64

6

BoxDrive.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    579s
  • max time network
    521s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/06/2024, 09:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BoxDrive.msi
  • Size 53.2MB
  • Sample240619-lskphssfll
  • SHA256 6682d653d3d14fa6cee669f29f60300e76a6aea323637db8487e641fad3b8560
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
adwarepersistenceprivilege_escalationpyinstallerstealer

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
    persistence
  • Drops file in Drivers directory 1 IoCs
  • Modifies Shared Task Scheduler registry keys 2 TTPs 4 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 17 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
    persistence
  • Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 4 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 56 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 30 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\BoxDrive.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2484
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Event Triggered Execution: Image File Execution Options Injection
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4664
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1564
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 72D3909271D08CB7DD1D47539A564B69
      2⤵
      • Loads dropped DLL
      PID:1720
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding D4B914AB0CEED4AE29A74171B09C7E0E E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:516
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIE9EA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240642578 41 Box.Desktop.Installer.CustomActions!CustomActions.CustomActions.CreateFallbackDeviceIDKey
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        PID:2156
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIF351.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240644953 47 Box.Desktop.Installer.CustomActions!Box.Desktop.Installer.CustomActions.CbfsInstallerCustomActions.InstallCbfs
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2984
        • C:\Program Files\Box\Box\FS\streem.exe
          "C:\Program Files\Box\Box\FS\streem.exe" --install-cbfs --cbfs-cab-path "C:\Program Files\Box\Box\FS\cbfsconnect.cab"
          4⤵
          • Adds autorun key to be loaded by Explorer.exe on startup
          • Drops file in Drivers directory
          • Modifies Shared Task Scheduler registry keys
          • Drops desktop.ini file(s)
          • Installs/modifies Browser Helper Object
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1776
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\SysWOW64\regsvr32.exe" /n /s /i:"cbfsconnect2017-Box" "C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\i386\cbfsconnectMntNtf2017.dll"
            5⤵
            • Adds autorun key to be loaded by Explorer.exe on startup
            • Modifies Shared Task Scheduler registry keys
            • Installs/modifies Browser Helper Object
            • Loads dropped DLL
            • Modifies registry class
            PID:5024
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding FEA2B7049AF8EAA2193E521B2134CAFA
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5116
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIF9BB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240646609 65 Box.Desktop.Installer.CustomActions!CustomActions.CustomActions.KillExplorer
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:2572
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIFA58.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240646765 75 Box.Desktop.Installer.CustomActions!CustomActions.CustomActions.GenerateDeviceId
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        PID:4880
    • C:\Program Files\Box\Box\Box.exe
      "C:\Program Files\Box\Box\Box.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2388
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:1484
        • C:\Program Files\Box\Box\ui\BoxUI.exe
          "C:\Program Files\Box\Box\ui\BoxUI.exe" --product-name Box
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:1644
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2144
    • C:\Program Files\Box\Box\Box.Desktop.UpdateService.exe
      "C:\Program Files\Box\Box\Box.Desktop.UpdateService.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      PID:4856
    • C:\Windows\system32\WerFault.exe
      "C:\Windows\system32\WerFault.exe" -s -t 4764 -i 1776 -e 1776 -c 0
      1⤵
        PID:512
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Loads dropped DLL
        • Checks SCSI registry key(s)
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1436
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1072
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3712
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3628
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3548
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3788
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4560
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:5056
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1672
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1316
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        PID:1468
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4348
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4008
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4148
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:3856
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3480
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3632
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:3592
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3712
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1104
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        PID:932
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4136
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2620
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:1732
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3592
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1440
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:3588
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4316
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:2264
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1224
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3560
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        PID:1228
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3116
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        PID:3540
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3048
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3824
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4136
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2088
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        PID:2784
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2152
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4052
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:652
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:180
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3236

      Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            4
            T1547

            Active Setup

            1
            T1547.014

            Registry Run Keys / Startup Folder

            3
            T1547.001

            Browser Extensions

            1
            T1176

            Event Triggered Execution

            3
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Image File Execution Options Injection

            1
            T1546.012

            Installer Packages

            1
            T1546.016

            Privilege Escalation

            Boot or Logon Autostart Execution

            4
            T1547

            Active Setup

            1
            T1547.014

            Registry Run Keys / Startup Folder

            3
            T1547.001

            Event Triggered Execution

            3
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Image File Execution Options Injection

            1
            T1546.012

            Installer Packages

            1
            T1546.016

            Defense Evasion

            Modify Registry

            6
            T1112

            Credential Access

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            3
            T1012

            System Information Discovery

            3
            T1082

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e57e35e.rbs
            • Path C:\Config.Msi\e57e35e.rbs
            • Size 472KB
            • SHA256 dabfadb6a08d8d65a4532787565cd0539c6385a02046ceac3714cb3a482bc1ec
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Box.Desktop.UpdateService.exe
            • Path C:\Program Files\Box\Box\Box.Desktop.UpdateService.exe
            • Size 97KB
            • SHA256 cf1e21697784ac1a84f6c22ef892b962fdbfac49591487cbe70a88dd11d514ac
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Box.Desktop.UpdateService.exe.config
            • Path C:\Program Files\Box\Box\Box.Desktop.UpdateService.exe.config
            • Size 175B
            • SHA256 c7e2c1cf5f11deaea818badcec637913ff438b6cea3d9209c86fc42bb49620d1
            • MD5 SHA1 SHA512
            Submit Download

            Box.Updater.Common.dll
            • Path C:\Program Files\Box\Box\Box.Updater.Common.dll
            • Size 88KB
            • SHA256 c91adec5d8c6b0223ffc05763154d01072afa141fba79c57164fd531b338e806
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Box.exe
            • Path C:\Program Files\Box\Box\Box.exe
            • Size 9.4MB
            • SHA256 a02ea3633a57dfea45bbf7265157e7352317d62b3b64f79182481fa479f82831
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cbfsconnect.cab
            • Path C:\Program Files\Box\Box\FS\cbfsconnect.cab
            • Size 2.3MB
            • SHA256 0203524031ab865791a4ecc4b4f0eb36cb5748e5bafdc63b6a3f7fd8d218f659
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            streem.exe
            • Path C:\Program Files\Box\Box\FS\streem.exe
            • Size 5.1MB
            • SHA256 7a4bde4bf5543e4631d902f85472959f6e144b971e9e69ee93eaef583ac271b7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Logger.dll
            • Path C:\Program Files\Box\Box\Logger.dll
            • Size 1.2MB
            • SHA256 9f56d60769d4899b4d8c925d6c0a899eb31a7b81ebc630e0442e93e39bcdf51f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MetricsCollector.dll
            • Path C:\Program Files\Box\Box\MetricsCollector.dll
            • Size 1.7MB
            • SHA256 f74b98fe878eb4c09432c1a66402ba0d358f369e6dc54bd83051db4a2fbc7c6e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cbfsconnectevtmsg.dll
            • Path C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\cbfsconnectevtmsg.dll
            • Size 13KB
            • SHA256 e49a24a201c9433f4f8168f278325c94ff83a5f69cae9eb58223f0053cfbb433
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cbfsconnectMntNtf2017.dll
            • Path C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\i386\cbfsconnectMntNtf2017.dll
            • Size 161KB
            • SHA256 584bea9e5a48f13ed73922eb2c716d1478a092bdc637cc16dbc432e119919ce6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vpnpbus.inf
            • Path C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\ia64\SHA1\vpnpbus.inf
            • Size 3KB
            • SHA256 586cc28d61aed1819c321014fa757623693d49b327ecbae3bd77d288850de84f
            • MD5 SHA1 SHA512
            Submit Download

            cbfsconnect2017.sys
            • Path C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\SHA1\cbfsconnect2017.sys
            • Size 461KB
            • SHA256 4ef226e535412c917f68b42773f540381cd0c16ab6ef6bedccd5f2751469af27
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vpnpbus.cat
            • Path C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\SHA1\vpnpbus.cat
            • Size 11KB
            • SHA256 110ad61efd1739cefb7d6b8795ee8f71c5c124a991bb4751d7dc8eaaaabe4510
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vpnpbus.sys
            • Path C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\SHA1\vpnpbus.sys
            • Size 19KB
            • SHA256 1f0d74127c21db1e3f1c51226c9b9d352982b89881acb50cdf6b66a655e702a6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cbfsconnect2017.sys
            • Path C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\cbfsconnect2017.sys
            • Size 471KB
            • SHA256 6852854b5edba760ffe1fb159f71a9c0c95b9e0bfc12e335fd9e6bdff6a9b38d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cbfsconnectMntNtf2017.dll
            • Path C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\cbfsconnectMntNtf2017.dll
            • Size 187KB
            • SHA256 82df2628a5b525a9f0ba529644c83ea8cb6a7ed894a84ab82448fed5c064d120
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cbfsconnectNetRdr2017.dll
            • Path C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\cbfsconnectNetRdr2017.dll
            • Size 266KB
            • SHA256 e5b69b230afd24b6b5cfe8b82c0bab87b58adf4f93dbac6f7ffbe310bae16074
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vpnpbus.cat
            • Path C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\vpnpbus.cat
            • Size 11KB
            • SHA256 8ae7d389b8a48de07345b54fff2fcbdea02cad6ee51998a97abaee448d976055
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vpnpbus.sys
            • Path C:\Program Files\Box\Box\Temp\cbfsconnect2017-Box\x64\vpnpbus.sys
            • Size 21KB
            • SHA256 f513a07fe88a43b6b4a2cafb4f24e2a6e5cbbe27877f984776b0fb9e5397c41f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            analytics_metrics.db
            • Path C:\Users\Admin\AppData\Local\Box\Box\data\analytics_metrics.db
            • Size 3KB
            • SHA256 e05c67635b6fe4cce8e56c8f0beba05c1346d96bb5514ae65e5273a3e821b7bb
            • MD5 SHA1 SHA512
            Submit Download

            cacert.pem
            • Path C:\Users\Admin\AppData\Local\Box\Box\data\cacert.pem
            • Size 302KB
            • SHA256 b706d8299b1d7c6b4fd18c9574ddae1bf5569225321204de7c16b2302d474361
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            rundll32.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
            • Size 651B
            • SHA256 d06099ef43eb002055378b1b6d9853f9b1f891ada476932ba575d1f97065a580
            • MD5 SHA1 SHA512
            Submit Download

            microsoft.windows[1].xml
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\WUYU8Y5R\microsoft.windows[1].xml
            • Size 97B
            • SHA256 1b12191f1bd84731c07f1493d0553255d66f7095a8cd896aec920cc2213db6c4
            • MD5 SHA1 SHA512
            Submit Download

            Microsoft_Windows_ControlPanel
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel
            • Size 36KB
            • SHA256 1649ec9493be27f76ae7304927d383f8a53dd3e41ea1678bacaff33120ea4170
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            https___docs_oracle_com_javase_8_docs
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___docs_oracle_com_javase_8_docs
            • Size 36KB
            • SHA256 813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppCache133632642213439950.txt
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133632642213439950.txt
            • Size 76KB
            • SHA256 85f27d10007dfe7c033dc17c3fa4c6a1a156bbd72b8e929da6343aa1bbed3485
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MSI74844.LOG
            • Path C:\Users\Admin\AppData\Local\Temp\MSI74844.LOG
            • Size 47KB
            • SHA256 a3bee325a663ea75a9863884d7e50b648db600ff34ca00a211211d47795e56de
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MSIE59D.tmp
            • Path C:\Windows\Installer\MSIE59D.tmp
            • Size 243KB
            • SHA256 fd3d6c50c3524063f7c28f815838e0fb06fd4ebff094e7b88902334abd463889
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MSIE68A.tmp
            • Path C:\Windows\Installer\MSIE68A.tmp
            • Size 380KB
            • SHA256 3a7d9cdd6be9ce0e4d01e9894242b497536336bf1850fb0a814a369c8a189c46
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MSIE814.tmp
            • Path C:\Windows\Installer\MSIE814.tmp
            • Size 548KB
            • SHA256 5fad8ac0929c29ff522bde7025f17774f2e996137cb349844b9595250d457cba
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MSIE9EA.tmp
            • Path C:\Windows\Installer\MSIE9EA.tmp
            • Size 375KB
            • SHA256 00b16f93458e2f5093302fdded70db6e0f813c3a17d96f8f6adafc2115b33310
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Box.Desktop.Installer.CustomActions.dll
            • Path C:\Windows\Installer\MSIE9EA.tmp-\Box.Desktop.Installer.CustomActions.dll
            • Size 54KB
            • SHA256 b1f96dceb94ea2f0f77001ed09ed6393ecdf87fb27c9dada0678190c465b35b9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            CustomAction.config
            • Path C:\Windows\Installer\MSIF351.tmp-\CustomAction.config
            • Size 1KB
            • SHA256 25c34915dae931917d9cf8a9b7b96b2983b44898b5037dca05dd4c9c65fe497f
            • MD5 SHA1 SHA512
            Submit Download

            WixToolset.Dtf.WindowsInstaller.dll
            • Path C:\Windows\Installer\MSIF351.tmp-\WixToolset.Dtf.WindowsInstaller.dll
            • Size 193KB
            • SHA256 bcc548e72b190d8f39dcb19538444e2576617a21caba6adcb4116511e1d2ddee
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Box.Updater.Common.dll
            • Path C:\Windows\Installer\MSIFA58.tmp-\Box.Updater.Common.dll
            • Size 78KB
            • SHA256 67a5be1306aa3e73dee167d1c83eb208935234094b230c3dec4b14be3cbe9eea
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 23.7MB
            • SHA256 142f3649bc66361b2a1132196ef8048506b07d5f2d20315081327e24eba12df9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            {2d0f805e-9547-4016-9602-a7a3b8f88235}_OnDiskSnapshotProp
            • Path \??\Volume{5110105b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2d0f805e-9547-4016-9602-a7a3b8f88235}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 900cd8c3382070f721804cc90e64e8fc6015f5c7872ac32d0e017f71c07d49a6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/652-1823-0x0000000004B90000-0x0000000004B91000-memory.dmp
            Download

            memory/932-1114-0x0000000004E70000-0x0000000004E71000-memory.dmp
            Download

            memory/1104-970-0x000001C67AB50000-0x000001C67AC50000-memory.dmp
            Download

            memory/1104-985-0x000001C67BA70000-0x000001C67BA90000-memory.dmp
            Download

            memory/1104-995-0x000001C67C080000-0x000001C67C0A0000-memory.dmp
            Download

            memory/1104-975-0x000001C67BAB0000-0x000001C67BAD0000-memory.dmp
            Download

            memory/1440-1242-0x000001624DA00000-0x000001624DB00000-memory.dmp
            Download

            memory/1440-1244-0x000001624DA00000-0x000001624DB00000-memory.dmp
            Download

            memory/1440-1259-0x000001624E720000-0x000001624E740000-memory.dmp
            Download

            memory/1440-1247-0x000001624E760000-0x000001624E780000-memory.dmp
            Download

            memory/1440-1270-0x000001624EF20000-0x000001624EF40000-memory.dmp
            Download

            memory/1468-667-0x0000000004D50000-0x0000000004D51000-memory.dmp
            Download

            memory/1644-465-0x0000022453EC0000-0x0000022453ED8000-memory.dmp
            Download

            memory/1644-466-0x0000022454730000-0x0000022454738000-memory.dmp
            Download

            memory/1644-470-0x00000224550A0000-0x00000224550FA000-memory.dmp
            Download

            memory/1644-469-0x0000022454680000-0x00000224546AE000-memory.dmp
            Download

            memory/1644-467-0x0000022454610000-0x0000022454648000-memory.dmp
            Download

            memory/1644-468-0x00000224545E0000-0x00000224545EE000-memory.dmp
            Download

            memory/1644-539-0x0000022C57510000-0x0000022C57CB6000-memory.dmp
            Download

            memory/1644-496-0x0000022455100000-0x0000022455148000-memory.dmp
            Download

            memory/1644-461-0x0000022438250000-0x0000022438AC8000-memory.dmp
            Download

            memory/1644-462-0x0000022438E70000-0x0000022438E7A000-memory.dmp
            Download

            memory/1644-463-0x000002243A880000-0x000002243A894000-memory.dmp
            Download

            memory/1644-464-0x0000022453EE0000-0x0000022453F14000-memory.dmp
            Download

            memory/1672-674-0x000001B47BB00000-0x000001B47BB20000-memory.dmp
            Download

            memory/1672-681-0x000001B47BAC0000-0x000001B47BAE0000-memory.dmp
            Download

            memory/1672-693-0x000001B47BED0000-0x000001B47BEF0000-memory.dmp
            Download

            memory/1732-1240-0x0000000004A80000-0x0000000004A81000-memory.dmp
            Download

            memory/2156-51-0x0000024477680000-0x0000024477692000-memory.dmp
            Download

            memory/2156-47-0x0000024477510000-0x0000024477544000-memory.dmp
            Download

            memory/2264-1383-0x0000000004A00000-0x0000000004A01000-memory.dmp
            Download

            memory/2388-428-0x000001CD35070000-0x000001CD350B0000-memory.dmp
            Download

            memory/2388-419-0x000001CD1B4C0000-0x000001CD1B4C8000-memory.dmp
            Download

            memory/2388-429-0x000001CD37960000-0x000001CD37F04000-memory.dmp
            Download

            memory/2388-430-0x000001CD37550000-0x000001CD375EC000-memory.dmp
            Download

            memory/2388-460-0x000001CD37910000-0x000001CD37942000-memory.dmp
            Download

            memory/2388-420-0x000001CD1B610000-0x000001CD1B618000-memory.dmp
            Download

            memory/2388-417-0x000001CD1B5F0000-0x000001CD1B65C000-memory.dmp
            Download

            memory/2388-459-0x000001CD37620000-0x000001CD37640000-memory.dmp
            Download

            memory/2388-431-0x000001CD37640000-0x000001CD377C6000-memory.dmp
            Download

            memory/2388-427-0x000001CD34FE0000-0x000001CD34FE8000-memory.dmp
            Download

            memory/2388-458-0x000001CD37600000-0x000001CD37612000-memory.dmp
            Download

            memory/2388-457-0x000001CD37E00000-0x000001CD38328000-memory.dmp
            Download

            memory/2388-454-0x000001CD375D0000-0x000001CD375D8000-memory.dmp
            Download

            memory/2388-426-0x000001CD35000000-0x000001CD35022000-memory.dmp
            Download

            memory/2388-416-0x00007FFB532D0000-0x00007FFB532DA000-memory.dmp
            Download

            memory/2388-415-0x000001CD1B400000-0x000001CD1B40A000-memory.dmp
            Download

            memory/2388-418-0x000001CD1B5F0000-0x000001CD1B60A000-memory.dmp
            Download

            memory/2388-432-0x000001CD35070000-0x000001CD35078000-memory.dmp
            Download

            memory/2620-1121-0x000001F2C85C0000-0x000001F2C85E0000-memory.dmp
            Download

            memory/2620-1132-0x000001F2C8580000-0x000001F2C85A0000-memory.dmp
            Download

            memory/2620-1152-0x000001F2C8990000-0x000001F2C89B0000-memory.dmp
            Download

            memory/2784-1678-0x0000000002A20000-0x0000000002A21000-memory.dmp
            Download

            memory/3236-1827-0x000001CFBE120000-0x000001CFBE220000-memory.dmp
            Download

            memory/3236-1825-0x000001CFBE120000-0x000001CFBE220000-memory.dmp
            Download

            memory/3236-1850-0x000001CFBF640000-0x000001CFBF660000-memory.dmp
            Download

            memory/3236-1840-0x000001CFBF230000-0x000001CFBF250000-memory.dmp
            Download

            memory/3236-1830-0x000001CFBF270000-0x000001CFBF290000-memory.dmp
            Download

            memory/3540-1529-0x0000000003000000-0x0000000003001000-memory.dmp
            Download

            memory/3560-1389-0x0000017063C80000-0x0000017063CA0000-memory.dmp
            Download

            memory/3560-1420-0x0000017064050000-0x0000017064070000-memory.dmp
            Download

            memory/3560-1397-0x0000017063C40000-0x0000017063C60000-memory.dmp
            Download

            memory/3560-1384-0x0000017062B20000-0x0000017062C20000-memory.dmp
            Download

            memory/3560-1385-0x0000017062B20000-0x0000017062C20000-memory.dmp
            Download

            memory/3592-968-0x0000000004C90000-0x0000000004C91000-memory.dmp
            Download

            memory/3628-505-0x00000211C1AB0000-0x00000211C1AD0000-memory.dmp
            Download

            memory/3628-500-0x00000211C0F50000-0x00000211C1050000-memory.dmp
            Download

            memory/3628-502-0x00000211C0F50000-0x00000211C1050000-memory.dmp
            Download

            memory/3628-514-0x00000211C1A70000-0x00000211C1A90000-memory.dmp
            Download

            memory/3628-537-0x00000211C1E80000-0x00000211C1EA0000-memory.dmp
            Download

            memory/3632-852-0x0000020F75C60000-0x0000020F75C80000-memory.dmp
            Download

            memory/3632-827-0x0000020F75690000-0x0000020F756B0000-memory.dmp
            Download

            memory/3632-838-0x0000020F75650000-0x0000020F75670000-memory.dmp
            Download

            memory/3788-498-0x00000000047D0000-0x00000000047D1000-memory.dmp
            Download

            memory/3824-1561-0x000001F9DB0E0000-0x000001F9DB100000-memory.dmp
            Download

            memory/3824-1544-0x000001F9DA9D0000-0x000001F9DA9F0000-memory.dmp
            Download

            memory/3824-1531-0x000001F9D9C00000-0x000001F9D9D00000-memory.dmp
            Download

            memory/3824-1532-0x000001F9D9C00000-0x000001F9D9D00000-memory.dmp
            Download

            memory/3824-1536-0x000001F9DAD20000-0x000001F9DAD40000-memory.dmp
            Download

            memory/3856-820-0x0000000003180000-0x0000000003181000-memory.dmp
            Download

            memory/4052-1703-0x000001EAA6FD0000-0x000001EAA6FF0000-memory.dmp
            Download

            memory/4052-1716-0x000001EAA76E0000-0x000001EAA7700000-memory.dmp
            Download

            memory/4052-1685-0x000001EAA7320000-0x000001EAA7340000-memory.dmp
            Download

            memory/4856-220-0x000002095E7A0000-0x000002095E7BA000-memory.dmp
            Download

            memory/4856-224-0x000002095EFF0000-0x000002095F008000-memory.dmp
            Download

            memory/4856-227-0x0000020977C60000-0x0000020977C72000-memory.dmp
            Download

            memory/4856-228-0x0000020977CC0000-0x0000020977CFC000-memory.dmp
            Download

            memory/4880-398-0x0000023781550000-0x0000023781568000-memory.dmp
            Download