Overview

overview

8

Static

static

7

08db701359...0e.exe

windows7-x64

8

08db701359...0e.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    68s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/09/2024, 18:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    08db701359377f4365ece1949bc1057b4e2d0f065a6e4661bf94abd3576cbf0e.exe

  • Size

    256KB

  • MD5

    33cc5f48ea5e335b0ff5625fa1c57458

  • SHA1

    8d781f0318829a6e5c7ec647afa7ee86343beb41

  • SHA256

    08db701359377f4365ece1949bc1057b4e2d0f065a6e4661bf94abd3576cbf0e

  • SHA512

    30c00240c4a63f0d79575b8ecbb9456da7b9af41f9afea12a91165b4507c8c281117e25e25d7adb28cda78838b4677264d00ec44a3d4196713f72835685d8988

  • SSDEEP

    6144:ADLQxoyQ1LpnFyZ+dayL9rvolH8u3ZhGod:YQCyQ1LHk+zR7QHjGo

Score
8/10
discoverypersistencevmprotect

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 15 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops file in Drivers directory 1 IoCs
  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Enumerates connected drives 3 TTPs 30 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 27 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\08db701359377f4365ece1949bc1057b4e2d0f065a6e4661bf94abd3576cbf0e.exe
    "C:\Users\Admin\AppData\Local\Temp\08db701359377f4365ece1949bc1057b4e2d0f065a6e4661bf94abd3576cbf0e.exe"
    1⤵
    • Drops file in Drivers directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer start page
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:664
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3780
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\yyyy.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:428
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3676
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1084
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:664
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3208
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1724
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4008
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:1072
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3432
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3144
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4148
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3064
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3304
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4188
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1620
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:468
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3212
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1764
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3544
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1480
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4292
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:1084
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4960
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3780
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:3792
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3372
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1480
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1828
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3280
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3392
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3204
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3448
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5016
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1736
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1848
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2776
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1296
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1208
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2276
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4444
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3908
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1796
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
      PID:4856
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:2428
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:3448
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:1388
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:640
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:4284
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:468
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:4232
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:748
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:3792
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:792
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4940
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:4396
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:3928
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:2588
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:3808
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:4864
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:1824
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:4388
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:1872
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:2128
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:2380
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:3164
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:2988
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:184
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:2348
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:3908
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:1064
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:3044
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:3796
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:2672
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:4896
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:4052
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:2852
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:628
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:2420
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:4128
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:2988
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:3696
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:3100
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:4832
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:4292
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:4216
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:3652
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:2784
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:776
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:4492
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:4152

                                                                                                  Network

                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                  Replay Monitor

                                                                                                  Loading Replay Monitor...

                                                                                                  Downloads

                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                    Filesize

                                                                                                    471B

                                                                                                    MD5

                                                                                                    ddab9ba6d995c9cccd95964b4ad4ce40

                                                                                                    SHA1

                                                                                                    5345a6d122113475b8a2b36b3273efe1ea48f4e8

                                                                                                    SHA256

                                                                                                    f492031400502c7376269631d12a43ee11b3908b03a1bb0da7882bf23b0a7e9b

                                                                                                    SHA512

                                                                                                    ed56b541c9bab8cfbbef667351774a27133d47f3269c193f77bdc0b3108c7d4c090657a9e9c1bfe446d58badb6c56b99565784f4db3e04b85cdd7993a8a0dde4

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                    Filesize

                                                                                                    420B

                                                                                                    MD5

                                                                                                    2d6eea469fb9296f93fe1355d0bb5d0a

                                                                                                    SHA1

                                                                                                    12a7a79ecbb7ebcb1bbd497b1d803b7cfe75576c

                                                                                                    SHA256

                                                                                                    05f9a22767322a642552967801bbef5113d007bda1dc647ad2dbb5c5cd0fb4ee

                                                                                                    SHA512

                                                                                                    e156c14082faa1e07ac39c0378ab112afd6ae171f40a9f77017a2a205aebf2d9343f548abcf8b93db37c5c45c483a307e6e4cb7fbf1bf48b026a441be4f51419

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    a53f9b4ec92dd66295f04e2a06bf3fac

                                                                                                    SHA1

                                                                                                    54646bed5728675873759f570cb2e3594664bd7f

                                                                                                    SHA256

                                                                                                    ccf566f3bc9511215ba08e7d0a896d8c8edd7dc656763b05b00ce387e43105cf

                                                                                                    SHA512

                                                                                                    8eaa9ce956f24da54abd26bc7aad68e66bb08e7f938bff8e530edd3ecea5be5a4b2126648b6287b1f81b2fa71cf282abd906eaaea9e71ec656e810f08082ad73

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
                                                                                                    Filesize

                                                                                                    36KB

                                                                                                    MD5

                                                                                                    0e2a09c8b94747fa78ec836b5711c0c0

                                                                                                    SHA1

                                                                                                    92495421ad887f27f53784c470884802797025ad

                                                                                                    SHA256

                                                                                                    0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                                                    SHA512

                                                                                                    61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
                                                                                                    Filesize

                                                                                                    36KB

                                                                                                    MD5

                                                                                                    ab0262f72142aab53d5402e6d0cb5d24

                                                                                                    SHA1

                                                                                                    eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                                                    SHA256

                                                                                                    20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                                                    SHA512

                                                                                                    bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\IHOCIHIW\microsoft.windows[1].xml
                                                                                                    Filesize

                                                                                                    96B

                                                                                                    MD5

                                                                                                    10447c28373b986c3dce4e7f2156814c

                                                                                                    SHA1

                                                                                                    03a482fa42dea8871c350394101b11f341ef6762

                                                                                                    SHA256

                                                                                                    376615a0b4dac87295162c3d924e67e4bf0dd77e02af1264c1520f22ec5378d8

                                                                                                    SHA512

                                                                                                    4fab536505b12b462254a2cfad102fabf29161a25f824de2b0201265c406f6a14b13049767bb2a6afff5ffe5e7703be0b7906a1740fea3d0dc2d6d8c13459abd

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yyyy
                                                                                                    Filesize

                                                                                                    256KB

                                                                                                    MD5

                                                                                                    b9a719fbee1cd27f76830ac7688a3cba

                                                                                                    SHA1

                                                                                                    434b4afe3f8b1b9bb6d46bfe0a90713d4c0e6921

                                                                                                    SHA256

                                                                                                    39844f94997490f34d8d0bb14cfd1d93062aecf349515a61c0440ed753937072

                                                                                                    SHA512

                                                                                                    2cb2f2fa90283655499fcf999526541f93e1e85317ac33bd5a025d1ba1f8750bc254cff6f053e5672dfacfa6b502aa7ba6eee670ccf6915929961ab9b7e569b6

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yyyy.bat
                                                                                                    Filesize

                                                                                                    337B

                                                                                                    MD5

                                                                                                    67991397936a8c2a5ce9851e4532d1ad

                                                                                                    SHA1

                                                                                                    e65773a60fafa0f2b33689392c9da26970171610

                                                                                                    SHA256

                                                                                                    3e849a9f4650b376b7d86d254e9b0b80d5095807b9ed5b2eee4195a8089ba1c7

                                                                                                    SHA512

                                                                                                    2c75ec036e8714a6f3295e019d2fbe8274f5123820a351ab80a1260eefe30ce1a5e2dc030bc1de32fb4afae2becb9917309cce6840825b9dc739d2791e0da732

                                                                                                    Download Submit

                                                                                                  • C:\Windows\System32\drivers\etc\hosts
                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    6f332dcaeeb548cceb98beb934ab3d55

                                                                                                    SHA1

                                                                                                    e48872682e514e95dcc14ff9bbdc6e0bef723fca

                                                                                                    SHA256

                                                                                                    7937ea22b6d3b09f8d41afef1371aaee906657aafce6678b0b449931a1a8c4c0

                                                                                                    SHA512

                                                                                                    e695693e246253fa969b57c20c4147009846d7848bc092c97aa830daf2f89e0c1a1850cb0c7e5715a95ebf19cdf58726eec3a9820f0b8820e495234ce22f2844

                                                                                                    Download Submit

                                                                                                  • memory/468-517-0x0000018457EC0000-0x0000018457EE0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/468-486-0x00000184578E0000-0x0000018457900000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/468-507-0x00000184578A0000-0x00000184578C0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/664-0-0x0000000000400000-0x000000000048C000-memory.dmp

                                                                                                    Filesize

                                                                                                    560KB

                                                                                                    Download

                                                                                                  • memory/664-14-0x0000000000400000-0x000000000048C000-memory.dmp

                                                                                                    Filesize

                                                                                                    560KB

                                                                                                    Download

                                                                                                  • memory/664-2-0x0000000000400000-0x000000000048C000-memory.dmp

                                                                                                    Filesize

                                                                                                    560KB

                                                                                                    Download

                                                                                                  • memory/1072-177-0x0000000001130000-0x0000000001131000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/1084-780-0x0000000004A00000-0x0000000004A01000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/1296-1521-0x0000000004780000-0x0000000004781000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/1480-951-0x000002A9E9000000-0x000002A9E9020000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/1480-939-0x000002A9E9040000-0x000002A9E9060000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/1480-970-0x000002A9E9400000-0x000002A9E9420000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/1736-1369-0x00000000030A0000-0x00000000030A1000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/1828-1079-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/2276-1525-0x0000021A4E700000-0x0000021A4E800000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/2276-1524-0x0000021A4E700000-0x0000021A4E800000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/2276-1523-0x0000021A4E700000-0x0000021A4E800000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/2776-1372-0x000001B68A600000-0x000001B68A700000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/2776-1371-0x000001B68A600000-0x000001B68A700000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/2776-1407-0x000001B68BAE0000-0x000001B68BB00000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/2776-1377-0x000001B68B500000-0x000001B68B520000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/2776-1401-0x000001B68B4C0000-0x000001B68B4E0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3144-205-0x000001CD038A0000-0x000001CD038C0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3144-184-0x000001CD034D0000-0x000001CD034F0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3144-195-0x000001CD03490000-0x000001CD034B0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3204-1227-0x0000000004070000-0x0000000004071000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/3208-27-0x00000000030F0000-0x00000000030F1000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/3212-627-0x00000000045F0000-0x00000000045F1000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/3304-329-0x00000233B8D40000-0x00000233B8E40000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/3304-328-0x00000233B8D40000-0x00000233B8E40000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/3304-333-0x00000233B9CA0000-0x00000233B9CC0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3304-361-0x00000233BA280000-0x00000233BA2A0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3304-348-0x00000233B9C60000-0x00000233B9C80000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3392-1111-0x0000019CDE310000-0x0000019CDE330000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3392-1099-0x0000019CDDF00000-0x0000019CDDF20000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3392-1087-0x0000019CDDF40000-0x0000019CDDF60000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3544-655-0x0000022C2F9A0000-0x0000022C2F9C0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3544-643-0x0000022C2F590000-0x0000022C2F5B0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3544-629-0x0000022C2E500000-0x0000022C2E600000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/3544-628-0x0000022C2E500000-0x0000022C2E600000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/3544-633-0x0000022C2F5D0000-0x0000022C2F5F0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3780-782-0x000001AF6E770000-0x000001AF6E870000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/3780-781-0x000001AF6E770000-0x000001AF6E870000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/3780-786-0x000001AF6F6D0000-0x000001AF6F6F0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3780-818-0x000001AF6FCA0000-0x000001AF6FCC0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3780-801-0x000001AF6F690000-0x000001AF6F6B0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3792-931-0x0000000003F20000-0x0000000003F21000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/4008-31-0x000001B9C2420000-0x000001B9C2520000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/4008-29-0x000001B9C2420000-0x000001B9C2520000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/4008-34-0x000001B9C3580000-0x000001B9C35A0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/4008-43-0x000001B9C3540000-0x000001B9C3560000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/4008-65-0x000001B9C3950000-0x000001B9C3970000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/4148-326-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/4188-478-0x00000000043F0000-0x00000000043F1000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/5016-1266-0x000001DBA85B0000-0x000001DBA85D0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/5016-1243-0x000001DBA7FA0000-0x000001DBA7FC0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/5016-1234-0x000001DBA7FE0000-0x000001DBA8000000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/5016-1230-0x000001DBA7100000-0x000001DBA7200000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/5016-1229-0x000001DBA7100000-0x000001DBA7200000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download