Overview

overview

10

Static

static

3

4842cfe7f5...24.exe

windows7-x64

8

4842cfe7f5...24.exe

windows10-2004-x64

10

Rapses.ps1

windows7-x64

3

Rapses.ps1

windows10-2004-x64

8

Analysis

  • max time kernel
    19s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-10-2024 01:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Rapses.ps1

  • Size

    51KB

  • MD5

    c7b38eb59906350c5320fba41407d4a7

  • SHA1

    2c6b4eda941d4f23d1d5969fc7cf06e689450de8

  • SHA256

    445c94fa7b8c3f9a7a84bc797ff21109431e9fe512b58d5b4e63581138cb0e61

  • SHA512

    f3c52188a2c107f1011ae156bd94c8d2465c1d767a166049b374f1bec023f0b123b185f280a5e3b8787bca065ae69ea8a2945eb68e88be778c202824d670bc19

  • SSDEEP

    1536:8OVz0fE7uE4vtvko03n0rytHgbzgj0nboBKC480B1gRf:zznQkDEyNcE0MBKCO1mf

Score
8/10
executionpersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 62 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 61 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Rapses.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1076
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:5060
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:116
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1596
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3528
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4132
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:4240
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3000
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:4756
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:1044
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:4312
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:1924
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:3632
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:1768
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4216
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:1956
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:3816
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:1624
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3456
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:4272
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:1608
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:3808
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:4868
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4460
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:1740
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:3024
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:3836
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:4600
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:4088
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:5108
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:4780
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:4440
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:3724
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:2540
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:1624
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:548
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:4964
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:4516
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:1864
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:3776
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:4296
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:4288
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:1736
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:1104
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:2172
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:3536
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:1324
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:3728
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:1204
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:3564
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:4652
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:2028
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:2072
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:4892
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:2316
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:3668
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:5020
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                    1⤵
                                                                                                      PID:3404
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:1176
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                          PID:4740
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                            PID:224
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:316
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:3684
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                1⤵
                                                                                                                  PID:1712
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:4140
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                    1⤵
                                                                                                                      PID:4868
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                        PID:3840
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                        1⤵
                                                                                                                          PID:4032
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                          1⤵
                                                                                                                            PID:2364
                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                            explorer.exe
                                                                                                                            1⤵
                                                                                                                              PID:4436
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                              1⤵
                                                                                                                                PID:2896
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                1⤵
                                                                                                                                  PID:1288
                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                  explorer.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:4256
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:1572
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                      1⤵
                                                                                                                                        PID:5028
                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                        explorer.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:3024
                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                          1⤵
                                                                                                                                            PID:4204
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                            1⤵
                                                                                                                                              PID:3900
                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                              explorer.exe
                                                                                                                                              1⤵
                                                                                                                                                PID:5084
                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                1⤵
                                                                                                                                                  PID:2660
                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                  1⤵
                                                                                                                                                    PID:1652
                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                    explorer.exe
                                                                                                                                                    1⤵
                                                                                                                                                      PID:1152
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                      1⤵
                                                                                                                                                        PID:996
                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                        explorer.exe
                                                                                                                                                        1⤵
                                                                                                                                                          PID:3284
                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                          1⤵
                                                                                                                                                            PID:4048
                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                            1⤵
                                                                                                                                                              PID:3620
                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                              explorer.exe
                                                                                                                                                              1⤵
                                                                                                                                                                PID:2864

                                                                                                                                                              Network

                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                              Replay Monitor

                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                              Downloads

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                                                                Filesize

                                                                                                                                                                2KB

                                                                                                                                                                MD5

                                                                                                                                                                821e5c902329368130d659b237b58574

                                                                                                                                                                SHA1

                                                                                                                                                                376a72472a0c293be9db400ce2c2b1e4998f32ac

                                                                                                                                                                SHA256

                                                                                                                                                                7ac3f7bcd61643ed0b7ec982e6e2fe09b04b89afea654d07d6b12d73873ff684

                                                                                                                                                                SHA512

                                                                                                                                                                cafbec09f05a66ab810e5d4f9f635b58be5bc6216d27528e2a913fc88e24d902ca04556d2e872c2da230bcf4fc096b1af0afe665629cbbd63e385ab8ff186f20

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133728572664033791.txt
                                                                                                                                                                Filesize

                                                                                                                                                                74KB

                                                                                                                                                                MD5

                                                                                                                                                                5ac4886b109637a3f8b8287b0bfbaef1

                                                                                                                                                                SHA1

                                                                                                                                                                dabf38d12f58b2ab749db41a764a03ab6ac6de84

                                                                                                                                                                SHA256

                                                                                                                                                                a615667e7be91f765b57f47f6d54634d049eb2c81a6f3a3ee5df0de8074237f1

                                                                                                                                                                SHA512

                                                                                                                                                                72c5d8e7b660e5e4ab6a08b0377c067e6d97ee0ea99fb483d412f5d426ea23c7d566b9aaf80dfb4a3432c2fbc42a372cb9e51ea083dbf4754316dee2e17a5c5b

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DGTT1KLJ\microsoft.windows[1].xml
                                                                                                                                                                Filesize

                                                                                                                                                                97B

                                                                                                                                                                MD5

                                                                                                                                                                dfc314c564e6dcc3d3d7f1d2cdf01ff5

                                                                                                                                                                SHA1

                                                                                                                                                                53a06942171b8047e4850e459554488280da265e

                                                                                                                                                                SHA256

                                                                                                                                                                56b9785b0255bd668bfdb7d6f789d1e54de550d567b85e52105893b8fbb45a08

                                                                                                                                                                SHA512

                                                                                                                                                                48688def79fffd15cd97505f73860552d7ad5069cd741214ca13225dd69eff4111338175bcb6fc9e1ed926f4bbc11b28865ab3df33aabf8bb7b8b68a0531f5f5

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ebeby3zc.pjz.ps1
                                                                                                                                                                Filesize

                                                                                                                                                                60B

                                                                                                                                                                MD5

                                                                                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                SHA1

                                                                                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                SHA256

                                                                                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                SHA512

                                                                                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                Download Submit

                                                                                                                                                              • memory/1076-17-0x00007FF824260000-0x00007FF824D21000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                10.8MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1076-14-0x0000025C2ADE0000-0x0000025C2AE04000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                144KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1076-15-0x00007FF824260000-0x00007FF824D21000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                10.8MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1076-13-0x0000025C2ADE0000-0x0000025C2AE0A000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                168KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1076-18-0x00007FF824260000-0x00007FF824D21000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                10.8MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1076-19-0x00007FF824260000-0x00007FF824D21000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                10.8MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1076-20-0x00007FF824260000-0x00007FF824D21000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                10.8MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1076-12-0x00007FF824260000-0x00007FF824D21000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                10.8MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1076-11-0x00007FF824260000-0x00007FF824D21000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                10.8MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1076-0-0x00007FF824263000-0x00007FF824265000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                8KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1076-6-0x0000025C2A8C0000-0x0000025C2A8E2000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                136KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1596-23-0x00000000043D0000-0x00000000043D1000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1608-760-0x0000000004370000-0x0000000004371000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1624-617-0x0000000004B90000-0x0000000004B91000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1624-1367-0x0000026DAC1B0000-0x0000026DAC1D0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1624-1389-0x0000026DAC580000-0x0000026DAC5A0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1624-1375-0x0000026DAC170000-0x0000026DAC190000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1624-1364-0x0000026DAB050000-0x0000026DAB150000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1024KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1768-341-0x0000013C25320000-0x0000013C25340000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1768-351-0x0000013C24FE0000-0x0000013C25000000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1768-373-0x0000013C256F0000-0x0000013C25710000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1768-336-0x0000013C241C0000-0x0000013C242C0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1024KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1768-338-0x0000013C241C0000-0x0000013C242C0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1024KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1768-337-0x0000013C241C0000-0x0000013C242C0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1024KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/1924-334-0x00000000042A0000-0x00000000042A1000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3024-919-0x000001BC28300000-0x000001BC28320000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3024-932-0x000001BC27FB0000-0x000001BC27FD0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3024-941-0x000001BC286C0000-0x000001BC286E0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3724-1360-0x0000000004A50000-0x0000000004A51000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3816-476-0x0000019F8EC20000-0x0000019F8ED20000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1024KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3816-475-0x0000019F8EC20000-0x0000019F8ED20000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1024KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3816-474-0x0000019F8EC20000-0x0000019F8ED20000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1024KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3816-479-0x0000019F8FD70000-0x0000019F8FD90000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3816-509-0x0000019F901D0000-0x0000019F901F0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3816-494-0x0000019F8FD30000-0x0000019F8FD50000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3836-1063-0x00000000048D0000-0x00000000048D1000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4088-1070-0x00000190D3640000-0x00000190D3660000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4088-1067-0x00000190D2500000-0x00000190D2600000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1024KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4088-1087-0x00000190D3600000-0x00000190D3620000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4088-1066-0x00000190D2500000-0x00000190D2600000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1024KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4088-1065-0x00000190D2500000-0x00000190D2600000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1024KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4088-1093-0x00000190D3A10000-0x00000190D3A30000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4132-26-0x000001BEF2E00000-0x000001BEF2F00000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1024KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4132-25-0x000001BEF2E00000-0x000001BEF2F00000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1024KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4132-30-0x000001BEF3F60000-0x000001BEF3F80000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4132-55-0x000001BEF4360000-0x000001BEF4380000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4132-38-0x000001BEF3F20000-0x000001BEF3F40000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4216-473-0x0000000002B20000-0x0000000002B21000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4272-656-0x00000295F3AC0000-0x00000295F3AE0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4272-639-0x00000295F2FB0000-0x00000295F2FD0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4272-619-0x00000295F2600000-0x00000295F2700000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1024KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4272-624-0x00000295F3300000-0x00000295F3320000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4272-621-0x00000295F2600000-0x00000295F2700000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1024KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4312-184-0x0000018CD6E00000-0x0000018CD6F00000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1024KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4312-200-0x0000018CD7F00000-0x0000018CD7F20000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4312-188-0x0000018CD7F40000-0x0000018CD7F60000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4312-210-0x0000018CD8300000-0x0000018CD8320000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4440-1210-0x0000019176E00000-0x0000019176F00000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1024KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4440-1211-0x0000019176E00000-0x0000019176F00000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1024KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4440-1235-0x0000019177CD0000-0x0000019177CF0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4440-1247-0x00000191782E0000-0x0000019178300000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4440-1215-0x0000019177D10000-0x0000019177D30000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4460-912-0x0000000004700000-0x0000000004701000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4756-182-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4868-767-0x000001CF14CF0000-0x000001CF14D10000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4868-788-0x000001CF152C0000-0x000001CF152E0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4868-764-0x000001CF13E00000-0x000001CF13F00000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1024KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4868-763-0x000001CF13E00000-0x000001CF13F00000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1024KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4868-779-0x000001CF14CB0000-0x000001CF14CD0000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                128KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/5108-1209-0x0000000004810000-0x0000000004811000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download