Overview

overview

10

Static

static

3

WinLogonON.exe

windows10-2004-x64

10

WinLogonON.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    235s
  • max time network
    300s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-09-2024 10:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    WinLogonON.exe

  • Size

    565KB

  • MD5

    be3e3d2a8c029d6cfb324af3c1cceee7

  • SHA1

    061f80dc9ec4c2935490e4e11c5861b58f5c4b1a

  • SHA256

    66b71d60c4103fb1b95be9e2d3d1501a15df33cb92bca1f0c81331b9b366895f

  • SHA512

    436eff8b25d51e7586fc9f754639e5e8e21c663bb4548cac5363dd1433fd556457e7daba832c8afd115d316c4cdd2d45fb5d67500a212e0d742a399ae3a0af2f

  • SSDEEP

    6144:HqV/h5brsnKupuuj1xgC00rWh/8PC80oR7XthcRqjzDkXmVJeMXerbibRSnhzCAy:K1BGuDC7ah/qC80od/zDoMXerDb3dAAk

Score
10/10
gurcuphemedronecredential_accessexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot6402440693:AAF1j3C2NXNnJXZ815ob_SOy3ipmEI30-5s/sendDocument

Extracted

Family

gurcu

C2

https://api.telegram.org/bot6402440693:AAF1j3C2NXNnJXZ815ob_SOy3ipmEI30-5s/sendDocumen

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 18 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Start PowerShell.

    execution
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 55 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\WinLogonON.exe
    "C:\Users\Admin\AppData\Local\Temp\WinLogonON.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4504
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" netsh advfirewall firewall add rule name="{6fHPw&"PfzZPe" dir=in action=allow program="C:\Users\Admin\WindowsSystem32.exe" enable=yes & exit
      2⤵
        PID:2416
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "DLLload.exe" /tr "C:\Users\Admin\WindowsSystem32.exe" /RL HIGHEST & exit
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:736
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /sc minute /mo 1 /tn "DLLload.exe" /tr "C:\Users\Admin\WindowsSystem32.exe" /RL HIGHEST
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1220
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "LoadingDLL32.exe" /tr "C:\Windows\DLLload.exe" /RL HIGHEST & exit
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2100
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /sc minute /mo 30 /tn "LoadingDLL32.exe" /tr "C:\Windows\DLLload.exe" /RL HIGHEST
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2368
      • C:\Users\Admin\WindowsSystem32.exe
        "C:\Users\Admin\WindowsSystem32.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:784
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp5213.tmp.exe"' & exit
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:392
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp5213.tmp.exe"'
            4⤵
            • Loads dropped DLL
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4968
            • C:\Users\Admin\AppData\Local\Temp\tmp5213.tmp.exe
              "C:\Users\Admin\AppData\Local\Temp\tmp5213.tmp.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3200
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp478F.tmp.exe"' & exit
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1988
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp478F.tmp.exe"'
            4⤵
            • Loads dropped DLL
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4672
            • C:\Users\Admin\AppData\Local\Temp\tmp478F.tmp.exe
              "C:\Users\Admin\AppData\Local\Temp\tmp478F.tmp.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              PID:1416
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c schtasks /deleTe /F /Tn "DLLload.exe" & exit& exit
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2760
          • C:\Windows\system32\schtasks.exe
            schtasks /deleTe /F /Tn "DLLload.exe"
            4⤵
              PID:4076
          • C:\Windows\SYSTEM32\CMD.exe
            "CMD" /c schtasks /deleTe /F /Tn "LoadingDLL32.exe" & exit& exit
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2224
            • C:\Windows\system32\schtasks.exe
              schtasks /deleTe /F /Tn "LoadingDLL32.exe"
              4⤵
                PID:3112
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd" /C taskkill /im explorer.exe /f && TimeOut 2 && start explorer.exe
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2400
              • C:\Windows\system32\taskkill.exe
                taskkill /im explorer.exe /f
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1540
              • C:\Windows\system32\timeout.exe
                TimeOut 2
                4⤵
                • Delays execution with timeout.exe
                PID:2952
              • C:\Windows\explorer.exe
                explorer.exe
                4⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:2940
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp200A.tmp.bat""
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4944
              • C:\Windows\system32\timeout.exe
                timeout 10 "C:\Users\Admin"DEL "WindowsSystem32.exe" /f /qCD "C:\Windows"DEL "DLLload.exe" /f /qCD "C:\Windows"DEL "xdwd.dll" /f /qCD "C:\Users\Admin\AppData\Local\Temp"DEL "tmp200A.tmp.bat" /f /q
                4⤵
                • Delays execution with timeout.exe
                PID:2076
        • C:\Users\Admin\WindowsSystem32.exe
          C:\Users\Admin\WindowsSystem32.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2144
        • C:\Users\Admin\WindowsSystem32.exe
          C:\Users\Admin\WindowsSystem32.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4040
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x4fc 0x428
          1⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4864
        • C:\Users\Admin\WindowsSystem32.exe
          C:\Users\Admin\WindowsSystem32.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4968
        • C:\Users\Admin\WindowsSystem32.exe
          C:\Users\Admin\WindowsSystem32.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2744
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2152
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:3796
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4960
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:3840
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2964
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4616
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of SendNotifyMessage
          PID:972
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:784
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3824
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:2952
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:3792
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:1264
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:4988
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3720
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:396
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:3792
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:4676
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:3700
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:3240
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:3912
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:1476
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:3884
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:4584
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:3240
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:5060
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:3152
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:396
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:3324
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:1136
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:2940
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:4876
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:1956
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:2036
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:3656
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:4268
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:60
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:1040
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:3636
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:4188
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:1392
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:4264
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:3780
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:3116
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:4228
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:3120
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:4944
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                        1⤵
                                                                                          PID:708
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:4132
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:3792
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                                PID:932
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:2172
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:2288
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                    1⤵
                                                                                                      PID:1600

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Reconnaissance

                                                                                                    Resource Development

                                                                                                    Initial Access

                                                                                                    Execution

                                                                                                    Command and Scripting Interpreter

                                                                                                    1
                                                                                                    T1059

                                                                                                    PowerShell

                                                                                                    1
                                                                                                    T1059.001

                                                                                                    Scheduled Task/Job

                                                                                                    1
                                                                                                    T1053

                                                                                                    Scheduled Task

                                                                                                    1
                                                                                                    T1053.005

                                                                                                    Persistence

                                                                                                    Boot or Logon Autostart Execution

                                                                                                    2
                                                                                                    T1547

                                                                                                    Active Setup

                                                                                                    1
                                                                                                    T1547.014

                                                                                                    Winlogon Helper DLL

                                                                                                    1
                                                                                                    T1547.004

                                                                                                    Event Triggered Execution

                                                                                                    1
                                                                                                    T1546

                                                                                                    AppInit DLLs

                                                                                                    1
                                                                                                    T1546.010

                                                                                                    Scheduled Task/Job

                                                                                                    1
                                                                                                    T1053

                                                                                                    Scheduled Task

                                                                                                    1
                                                                                                    T1053.005

                                                                                                    Privilege Escalation

                                                                                                    Boot or Logon Autostart Execution

                                                                                                    2
                                                                                                    T1547

                                                                                                    Active Setup

                                                                                                    1
                                                                                                    T1547.014

                                                                                                    Winlogon Helper DLL

                                                                                                    1
                                                                                                    T1547.004

                                                                                                    Event Triggered Execution

                                                                                                    1
                                                                                                    T1546

                                                                                                    AppInit DLLs

                                                                                                    1
                                                                                                    T1546.010

                                                                                                    Scheduled Task/Job

                                                                                                    1
                                                                                                    T1053

                                                                                                    Scheduled Task

                                                                                                    1
                                                                                                    T1053.005

                                                                                                    Defense Evasion

                                                                                                    Modify Registry

                                                                                                    3
                                                                                                    T1112

                                                                                                    Credential Access

                                                                                                    Credentials from Password Stores

                                                                                                    1
                                                                                                    T1555

                                                                                                    Credentials from Web Browsers

                                                                                                    1
                                                                                                    T1555.003

                                                                                                    Unsecured Credentials

                                                                                                    3
                                                                                                    T1552

                                                                                                    Credentials In Files

                                                                                                    3
                                                                                                    T1552.001

                                                                                                    Discovery

                                                                                                    Peripheral Device Discovery

                                                                                                    2
                                                                                                    T1120

                                                                                                    Query Registry

                                                                                                    4
                                                                                                    T1012

                                                                                                    System Information Discovery

                                                                                                    4
                                                                                                    T1082

                                                                                                    Lateral Movement

                                                                                                    Collection

                                                                                                    Data from Local System

                                                                                                    2
                                                                                                    T1005

                                                                                                    Command and Control

                                                                                                    Exfiltration

                                                                                                    Impact

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                      Filesize

                                                                                                      471B

                                                                                                      MD5

                                                                                                      c2e3b19a475aba9622a002387bd2aaa1

                                                                                                      SHA1

                                                                                                      bf439c5f982ad810dfa9d78785b2a813df64b255

                                                                                                      SHA256

                                                                                                      aa76eaece289cfa33f37ffa302aeaaf97192c794e1dc28c1eea226f863139872

                                                                                                      SHA512

                                                                                                      83d445bf2b3782644954511cb56d135922c15aa1e0e9ea4aa4b53749234110283419a198190410f89b8e1d25cbfe7e02abd9c689ca84262edfe1f0ba3db3564d

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                      Filesize

                                                                                                      420B

                                                                                                      MD5

                                                                                                      637c897512e986aa6174098aeaabfc42

                                                                                                      SHA1

                                                                                                      8dd36a3f93c26a75277c86bfea963fbe38a5048b

                                                                                                      SHA256

                                                                                                      913cf82d295971186b01d7402a68fbde3115c2f8a9a295d82f5ffeacd7151f60

                                                                                                      SHA512

                                                                                                      f9aced1acdee9219fa92489ff8e493f37f0f44f9c94958f74ac922d43e77e17a6848a2a098786bd38943e135340eaf6d6ba0defa30d7066bd97a7b714062217b

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WindowsSystem32.exe.log
                                                                                                      Filesize

                                                                                                      642B

                                                                                                      MD5

                                                                                                      e19ed69089e56bbfaaba5e5e63d0354f

                                                                                                      SHA1

                                                                                                      287519bf7c4ec630e4326db00809f627f927ebef

                                                                                                      SHA256

                                                                                                      f9481e31897c3d9071b744e1638942b52c46858c16ccf692f5c6e109a8b092f6

                                                                                                      SHA512

                                                                                                      c4a8678d28eea4c3a3adfe0324943478efabef839d3bdacb0e4c278e97ee356037c0bfd83b096952b43d81af0b7253eb7d666416e0024ce93a1c516a834fd05b

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      6cf293cb4d80be23433eecf74ddb5503

                                                                                                      SHA1

                                                                                                      24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                      SHA256

                                                                                                      b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                      SHA512

                                                                                                      0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                      Filesize

                                                                                                      64B

                                                                                                      MD5

                                                                                                      1a11402783a8686e08f8fa987dd07bca

                                                                                                      SHA1

                                                                                                      580df3865059f4e2d8be10644590317336d146ce

                                                                                                      SHA256

                                                                                                      9b1d1b468932a2d88548dc18504ac3066f8248079ecb083e919460bdb88398c0

                                                                                                      SHA512

                                                                                                      5f7f9f76d9d12a25fdc5b8d193391fb42c37515c657250fe01a9bfd9fe4cc4eab9d5ec254b2596ac1b9005f12511905f19fdae41f057062261d75bd83254b510

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      ffec54b4f740304e9c3f4251c33bde56

                                                                                                      SHA1

                                                                                                      5be0876b3114f245cd4f8b314883c71b486c32f2

                                                                                                      SHA256

                                                                                                      e75276dd120106e593d769b30126edc2f3b45e0e3a80ad2a20040406b6f3715f

                                                                                                      SHA512

                                                                                                      0c84d2ca02aabbe0dbbed0fa151b586775e0af2fbbd5d7f2c5ca24837c6ae13e732d6f05a356bfb60ef7d459f9d29ccfa94bd0c0cb63d5342a4046274fb33c80

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\VJ9UXBET\microsoft.windows[1].xml
                                                                                                      Filesize

                                                                                                      97B

                                                                                                      MD5

                                                                                                      d28bf9e615b97abc4f63418e57cc40bc

                                                                                                      SHA1

                                                                                                      65885f634c0b15cabd1caf45861e7767f3110e44

                                                                                                      SHA256

                                                                                                      92e5c802db2c618a0c0aec072bec43479f082c95f35157b117749fee0ec295f7

                                                                                                      SHA512

                                                                                                      23e0b838c4a4a91b117fa0292e0350d691aa78eda49299819aa684efd6c6ec03b73a7d231996cf4d7e6cd10311a4755b5a434cae732c6376276290cb52f12eb0

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nib4amkf.qye.ps1
                                                                                                      Filesize

                                                                                                      60B

                                                                                                      MD5

                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                      SHA1

                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                      SHA256

                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                      SHA512

                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmp200A.tmp.bat
                                                                                                      Filesize

                                                                                                      204B

                                                                                                      MD5

                                                                                                      8ab1182f4f2a05e82d9a8ca6afa2eb75

                                                                                                      SHA1

                                                                                                      7daa1b2ca9dbc3bc19319cd2e675e405b10ec517

                                                                                                      SHA256

                                                                                                      d6754b0dae1a5bd2571269c0165a16424070c99d3ca97b0d3fcfde63ebf99c70

                                                                                                      SHA512

                                                                                                      d0a185ed6e66af567315505de6647bf365fb7c4120086a2a7fcedcd3c0c9de18936798e1562c593cc915d14c2448729c37c1c78b0d684866ab92b002d986c4d7

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmp478F.tmp.exe
                                                                                                      Filesize

                                                                                                      5.6MB

                                                                                                      MD5

                                                                                                      8235f398b63cb2b0926edf528a56ad35

                                                                                                      SHA1

                                                                                                      668ff71112d6bf289b70659d063d524481c19b0f

                                                                                                      SHA256

                                                                                                      0091be76fcfaadfb4d45f22ce3cb5189fd919ee89cfb901c9eed7f6a6aa61c6a

                                                                                                      SHA512

                                                                                                      51cf7794ea120ebaad6d53b2722f35e57b1d28b5365e53a74d945f45d180d6a5bfe3b27f963485c53079103947e552c88631485ba49a160a4b09c9afd4a66674

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmp5213.tmp.exe
                                                                                                      Filesize

                                                                                                      268KB

                                                                                                      MD5

                                                                                                      5a42f6ec53d033021cb7991e69e678f9

                                                                                                      SHA1

                                                                                                      cae100d89478cb724cb8b6439141fb4a245a3ec1

                                                                                                      SHA256

                                                                                                      6d80a6a43d3894ce23014f22dfb96418a61012cb5f6773ce34d7bb8dd2aaafad

                                                                                                      SHA512

                                                                                                      25ad1c2eacdd0dd68a485c0589b4ab5aa0d66b43e17dcd2de0fc7447429c8611b817fe7ff60e0beef79fb6553fa7bff49837b38c4350bddadaedcd603961fd00

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\WindowsSystem32.exe
                                                                                                      Filesize

                                                                                                      565KB

                                                                                                      MD5

                                                                                                      be3e3d2a8c029d6cfb324af3c1cceee7

                                                                                                      SHA1

                                                                                                      061f80dc9ec4c2935490e4e11c5861b58f5c4b1a

                                                                                                      SHA256

                                                                                                      66b71d60c4103fb1b95be9e2d3d1501a15df33cb92bca1f0c81331b9b366895f

                                                                                                      SHA512

                                                                                                      436eff8b25d51e7586fc9f754639e5e8e21c663bb4548cac5363dd1433fd556457e7daba832c8afd115d316c4cdd2d45fb5d67500a212e0d742a399ae3a0af2f

                                                                                                      Download Submit

                                                                                                    • C:\Windows\xdwd.dll
                                                                                                      Filesize

                                                                                                      136KB

                                                                                                      MD5

                                                                                                      16e5a492c9c6ae34c59683be9c51fa31

                                                                                                      SHA1

                                                                                                      97031b41f5c56f371c28ae0d62a2df7d585adaba

                                                                                                      SHA256

                                                                                                      35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

                                                                                                      SHA512

                                                                                                      20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

                                                                                                      Download Submit

                                                                                                    • memory/60-1768-0x0000000004600000-0x0000000004601000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/396-754-0x000001B9F0BA0000-0x000001B9F0BC0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/396-778-0x000001B9F0F70000-0x000001B9F0F90000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/396-768-0x000001B9F0B60000-0x000001B9F0B80000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/396-1340-0x0000000004500000-0x0000000004501000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/784-246-0x0000000001090000-0x000000000109C000-memory.dmp

                                                                                                      Filesize

                                                                                                      48KB

                                                                                                      Download

                                                                                                    • memory/784-241-0x000000001F130000-0x000000001F1FA000-memory.dmp

                                                                                                      Filesize

                                                                                                      808KB

                                                                                                      Download

                                                                                                    • memory/784-240-0x0000000002D70000-0x0000000002D82000-memory.dmp

                                                                                                      Filesize

                                                                                                      72KB

                                                                                                      Download

                                                                                                    • memory/972-462-0x0000000004D00000-0x0000000004D01000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/1136-1343-0x0000024FE6100000-0x0000024FE6200000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                      Download

                                                                                                    • memory/1136-1346-0x0000024FE7200000-0x0000024FE7220000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/1136-1341-0x0000024FE6100000-0x0000024FE6200000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                      Download

                                                                                                    • memory/1136-1342-0x0000024FE6100000-0x0000024FE6200000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                      Download

                                                                                                    • memory/1136-1359-0x0000024FE6FC0000-0x0000024FE6FE0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/1136-1370-0x0000024FE75D0000-0x0000024FE75F0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/1264-631-0x000001FFFCD50000-0x000001FFFCD70000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/1264-619-0x000001FFFC940000-0x000001FFFC960000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/1264-610-0x000001FFFC980000-0x000001FFFC9A0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/1416-288-0x00000000003D0000-0x0000000000978000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.7MB

                                                                                                      Download

                                                                                                    • memory/1476-1046-0x00000000049D0000-0x00000000049D1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/1956-1499-0x000001F3A5280000-0x000001F3A52A0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/1956-1509-0x000001F3A58A0000-0x000001F3A58C0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/1956-1480-0x000001F3A52C0000-0x000001F3A52E0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/2036-1618-0x0000000004B10000-0x0000000004B11000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/2940-1473-0x0000000004020000-0x0000000004021000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/2952-602-0x0000000004160000-0x0000000004161000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/3152-1189-0x000002B075100000-0x000002B075200000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                      Download

                                                                                                    • memory/3152-1206-0x000002B076180000-0x000002B0761A0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/3152-1194-0x000002B0761C0000-0x000002B0761E0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/3152-1216-0x000002B076590000-0x000002B0765B0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/3200-265-0x0000000000360000-0x00000000003A8000-memory.dmp

                                                                                                      Filesize

                                                                                                      288KB

                                                                                                      Download

                                                                                                    • memory/3240-1188-0x0000000004B50000-0x0000000004B51000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/3636-1775-0x0000021CF0370000-0x0000021CF0390000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/3636-1799-0x0000021CF0740000-0x0000021CF0760000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/3636-1787-0x0000021CF0330000-0x0000021CF0350000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/3636-1772-0x0000021CEF220000-0x0000021CEF320000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                      Download

                                                                                                    • memory/3700-894-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/3824-491-0x00000201606C0000-0x00000201606E0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/3824-482-0x000002015FDA0000-0x000002015FDC0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/3824-469-0x000002015FDE0000-0x000002015FE00000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/3824-466-0x000002015F200000-0x000002015F300000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                      Download

                                                                                                    • memory/3824-464-0x000002015F200000-0x000002015F300000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                      Download

                                                                                                    • memory/3840-307-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/3912-925-0x00000220DCEA0000-0x00000220DCEC0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/3912-913-0x00000220DC890000-0x00000220DC8B0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/3912-896-0x00000220DB970000-0x00000220DBA70000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                      Download

                                                                                                    • memory/3912-898-0x00000220DB970000-0x00000220DBA70000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                      Download

                                                                                                    • memory/3912-901-0x00000220DC8D0000-0x00000220DC8F0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4188-1919-0x0000000004A60000-0x0000000004A61000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download

                                                                                                    • memory/4268-1654-0x00000268F8230000-0x00000268F8250000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4268-1655-0x00000268F8640000-0x00000268F8660000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4268-1624-0x00000268F8270000-0x00000268F8290000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4504-233-0x00007FFA7FD30000-0x00007FFA807F1000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                      Download

                                                                                                    • memory/4504-0-0x00007FFA7FD33000-0x00007FFA7FD35000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      Download

                                                                                                    • memory/4504-9-0x00007FFA7FD30000-0x00007FFA807F1000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                      Download

                                                                                                    • memory/4504-1-0x0000000000FD0000-0x0000000001062000-memory.dmp

                                                                                                      Filesize

                                                                                                      584KB

                                                                                                      Download

                                                                                                    • memory/4504-18-0x00007FFA7FD30000-0x00007FFA807F1000-memory.dmp

                                                                                                      Filesize

                                                                                                      10.8MB

                                                                                                      Download

                                                                                                    • memory/4584-1061-0x0000020ED6420000-0x0000020ED6440000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4584-1073-0x0000020ED6830000-0x0000020ED6850000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4584-1054-0x0000020ED6460000-0x0000020ED6480000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4584-1048-0x0000020ED5300000-0x0000020ED5400000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                      Download

                                                                                                    • memory/4616-310-0x000001D940A40000-0x000001D940B40000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                      Download

                                                                                                    • memory/4616-325-0x000001D941B50000-0x000001D941B70000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4616-340-0x000001D941F60000-0x000001D941F80000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4616-309-0x000001D940A40000-0x000001D940B40000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                      Download

                                                                                                    • memory/4616-314-0x000001D941B90000-0x000001D941BB0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                      Download

                                                                                                    • memory/4968-250-0x0000026CA9020000-0x0000026CA9042000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                      Download

                                                                                                    • memory/4988-746-0x0000000004330000-0x0000000004331000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download