Overview

overview

8

Static

static

3

8c5a359766...67.exe

windows7-x64

1

8c5a359766...67.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    72s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-11-2024 15:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8c5a3597666f418b5c857e68c9a13b7b6d037ea08a988204b572f053450add67.exe

  • Size

    10.6MB

  • MD5

    f164888a6fbc646b093f6af6663f4e63

  • SHA1

    3c0bb9f9a4ad9b1c521ad9fc30ec03668577c97c

  • SHA256

    8c5a3597666f418b5c857e68c9a13b7b6d037ea08a988204b572f053450add67

  • SHA512

    f1b2173962561d3051ec6b5aa2fc0260809e37e829255d95c8a085f990c18b724daff4372f646d505dabe3cc3013364d4316c2340527c75d140dbc6b5ebdeee1

  • SSDEEP

    196608:Yobw/inDWIRviYy06kRUEsyiFo2ItCC2bO+WxNtTYnepC5YbM/rN2kGBlSrnU:dw/2Bvc06kiEviXTCIKNtUnqYYA/A

Score
8/10
discoveryevasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 13 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Loads dropped DLL 29 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 9 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 43 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\8c5a3597666f418b5c857e68c9a13b7b6d037ea08a988204b572f053450add67.exe
    "C:\Users\Admin\AppData\Local\Temp\8c5a3597666f418b5c857e68c9a13b7b6d037ea08a988204b572f053450add67.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4476
    • C:\Windows\system32\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3048
    • C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
      2⤵
      • Launches sc.exe
      PID:1088
    • C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
      2⤵
      • Launches sc.exe
      PID:2448
    • C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:2432
    • C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:2356
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Loads dropped DLL
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:264
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:2632
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:4332
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:3400
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2308
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:4984
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:4256
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4832
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:2880
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:4016
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:3944
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of SetWindowsHookEx
    PID:3968
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:3952
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1324
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:376
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:1120
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3112
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of SetWindowsHookEx
    PID:2916
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:2688
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4856
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3244
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:1224
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:720
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:940
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:2632
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4840
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1844
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:3084
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:884
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of SetWindowsHookEx
    PID:4612
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    PID:3020
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3068
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:4552
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:1824
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4936
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Loads dropped DLL
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2676
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:2536
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
      PID:1176
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:808
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:1732
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:2576
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:4952
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:4984
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:4272
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:4236
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:448
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:808
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:3628
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:4872
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:2904
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:4640
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:3068
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:4780
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:3552
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:1060
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:3244
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:2460
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:4812
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:4236
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:428
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:4068
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:3020
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:4780
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:1548

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Reconnaissance

                                                        Resource Development

                                                        Initial Access

                                                        Execution

                                                        System Services

                                                        1
                                                        T1569

                                                        Service Execution

                                                        1
                                                        T1569.002

                                                        Persistence

                                                        Boot or Logon Autostart Execution

                                                        1
                                                        T1547

                                                        Active Setup

                                                        1
                                                        T1547.014

                                                        Create or Modify System Process

                                                        1
                                                        T1543

                                                        Windows Service

                                                        1
                                                        T1543.003

                                                        Event Triggered Execution

                                                        1
                                                        T1546

                                                        Component Object Model Hijacking

                                                        1
                                                        T1546.015

                                                        Privilege Escalation

                                                        Boot or Logon Autostart Execution

                                                        1
                                                        T1547

                                                        Active Setup

                                                        1
                                                        T1547.014

                                                        Create or Modify System Process

                                                        1
                                                        T1543

                                                        Windows Service

                                                        1
                                                        T1543.003

                                                        Event Triggered Execution

                                                        1
                                                        T1546

                                                        Component Object Model Hijacking

                                                        1
                                                        T1546.015

                                                        Defense Evasion

                                                        Impair Defenses

                                                        1
                                                        T1562

                                                        Modify Registry

                                                        2
                                                        T1112

                                                        Credential Access

                                                        Discovery

                                                        Peripheral Device Discovery

                                                        2
                                                        T1120

                                                        Query Registry

                                                        5
                                                        T1012

                                                        System Information Discovery

                                                        4
                                                        T1082

                                                        Lateral Movement

                                                        Collection

                                                        Command and Control

                                                        Exfiltration

                                                        Impact

                                                        Service Stop

                                                        1
                                                        T1489

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Program Files\ExplorerPatcher\WebView2Loader.dll
                                                          Filesize

                                                          161KB

                                                          MD5

                                                          c5f0c46e91f354c58ecec864614157d7

                                                          SHA1

                                                          cb6f85c0b716b4fc3810deb3eb9053beb07e803c

                                                          SHA256

                                                          465a7ddfb3a0da4c3965daf2ad6ac7548513f42329b58aebc337311c10ea0a6f

                                                          SHA512

                                                          287756078aa08130907bd8601b957e9e006cef9f5c6765df25cfaa64ddd0fff7d92ffa11f10a00a4028687f3220efda8c64008dbcf205bedae5da296e3896e91

                                                          Download Submit

                                                        • C:\Program Files\ExplorerPatcher\ep_gui.dll
                                                          Filesize

                                                          734KB

                                                          MD5

                                                          81cd6d96f81b1e54aa327a4af6bcbe85

                                                          SHA1

                                                          b786c4bde03d1566b1b040eb8970b82f7b80a007

                                                          SHA256

                                                          b23bab1f5dc85c9e10145eeb32214d6cfe02fb5abcf956a37a3c9dd7e09fee67

                                                          SHA512

                                                          a1360b71ba11b529bd21f8c93c6ceec01c4faa9d33ca5e5fa62acb118cebf1e9e1d38ea17d236d1f8bd0d790f6b743329d41598d5a62c794b4786c14975782be

                                                          Download Submit

                                                        • C:\Program Files\ExplorerPatcher\ep_weather_host.dll
                                                          Filesize

                                                          238KB

                                                          MD5

                                                          aac2857727cff3cd7b291f9500196f73

                                                          SHA1

                                                          c86eedff45b672df58885f12e7a7aee3398c618b

                                                          SHA256

                                                          78ed3e3676d97c337fef071b522805f4cf742587a40f96af4aa4d74fee0af88a

                                                          SHA512

                                                          a4c54b4221b1745fe1de6d53fcd7a528b4bacda6b2c66e02d55bd5867d118e042a35490e45b64c2d24398a9ac06e356bf10a2822f83663d52c1a28e10f0a52e5

                                                          Download Submit

                                                        • C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll
                                                          Filesize

                                                          109KB

                                                          MD5

                                                          e477912c435db101603781dcc44289e1

                                                          SHA1

                                                          7b2eda1b6055e8874f37fb9b48bcc933bf69c1c3

                                                          SHA256

                                                          0930d2e71353a411d96dc4dfdd473dace98d1b7b9546ac4c185f8984f8b9c18b

                                                          SHA512

                                                          9f8089742099a789387381980ec5b493deec46bd73f39cf8fa9919be4dd772b20c70246e5e90d625011f052d5c3b2000b42c50843956d74fb85ff1b1d18eace9

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                          Filesize

                                                          471B

                                                          MD5

                                                          a44969ec0b7714c574b13765062c1527

                                                          SHA1

                                                          d45914a90e536af238f33334cb13955db3926db9

                                                          SHA256

                                                          4761e2eb7204122f95ea51772fd1d811d4d5a5d68f1109b8c012654e1ebcb7a2

                                                          SHA512

                                                          98fee04e09a0fea7dfb8bde59832b77f361a4fcf863772435d6b458a8fac0d3e2bac136d16674787106c2c459b10eff17b412ac5e68fc50a21483c17e82bf47c

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                          Filesize

                                                          412B

                                                          MD5

                                                          f7438fbf1ca39097a056e9afd2372b80

                                                          SHA1

                                                          f9d7b4bdbfb7eb9b69c476f1be8d096a17af778c

                                                          SHA256

                                                          c458bdd3604c5e62e3e7194a2b86e4ecd1b58798d7b2982ab60b0672b0fdb7f0

                                                          SHA512

                                                          cba361ec13869e19ef911d2d387f7288e60f304e855d46819a85dbd3b142a013b44c03e2837d165414a8993f5446fdbf370d162101ae5ec7188546f4f1a18fea

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                          Filesize

                                                          2KB

                                                          MD5

                                                          1354685f1353145efea21f3ea5bdec98

                                                          SHA1

                                                          0514d3a42ad932ee8a7c2d3411839e701caaa88e

                                                          SHA256

                                                          9f77cbba5ab13203b0d5fc09d0c6c4b48378e72b8f42a462041cb249eb4d055d

                                                          SHA512

                                                          89147b9d481c9eb1bd50fc03b6f9a1d62476bfde400985d2f994ffbe9001d9437a5402b35d8b45538436e53fc437ce41ba44e2e7f82521316c1f7238def837cc

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133752925691699496.txt
                                                          Filesize

                                                          75KB

                                                          MD5

                                                          9efb904a9f693d909c0954f1bfdd8845

                                                          SHA1

                                                          98989171ab250eddb107c90d8e7206e867555e41

                                                          SHA256

                                                          0b4c3708f76b34ad12479bc0e8041c2d959404cf85e17f4d491c80cef33de2f2

                                                          SHA512

                                                          a074b5cb2bec431f4328cec1cff1f6981d92db184a654b3dc2b7547e486f43e8ce3777ec3cbce00e5f1ad1ce87074c1a92c3493bc41264ef9ad7a54d4bd58d27

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\80AM9X7C\microsoft.windows[1].xml
                                                          Filesize

                                                          96B

                                                          MD5

                                                          c839a1973d3feaead377ea2dad131fe6

                                                          SHA1

                                                          252758616792b9b2f10bc460c84b1c1eba75ea04

                                                          SHA256

                                                          efecd8d483398a6cb569af17e66cb0ba1ca4b9c65f4a697fc7642cc007fc3ccd

                                                          SHA512

                                                          fee6ca3d2ae272b0f1f291e98830215f2ac138747651be78325ab7c1ba3f01f72cbfed4c886853caba45f16c59c78543a87a5f872b2c1f85bffa3a4e11bf50e1

                                                          Download Submit

                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll
                                                          Filesize

                                                          699KB

                                                          MD5

                                                          8bfca71add96d3de75173d464792e2b9

                                                          SHA1

                                                          fe6bc3c30c26d6ce1c149b173b5d79c80102d5b9

                                                          SHA256

                                                          5aaa6bab20b7116b32bddba1df216f7476557bb48397e1968a49ede14e6c377d

                                                          SHA512

                                                          b560415727d15ceeb09e5d9e39ea2b4043848bf4239fbf5068aaac86f64b3d05d4e21eb197416db0fb4172c68f782c05aeae18ac70c27f80566040b6ba79159a

                                                          Download Submit

                                                        • C:\Windows\dxgi.dll
                                                          Filesize

                                                          699KB

                                                          MD5

                                                          047b192a9c703fc5a2c2764db869ff5c

                                                          SHA1

                                                          8c1494acc3119fbf8332ae3b6a4f854e5b4d37cb

                                                          SHA256

                                                          1971c57f88849b4069be06d3784e0968755c916fa1564a3f8f05610d3b02cdcc

                                                          SHA512

                                                          c7f80703db23611d56618a8b1b4ffff814a9264135e3846df99120c0ffc16da9d5b37c6465ac25d61d4f6e386d36b3de640c57c460098f06778c658cc19454cc

                                                          Download Submit

                                                        • memory/264-35-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-36-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-39-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-40-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-45-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-48-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-47-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-49-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-55-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-54-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-50-0x00007FF881D60000-0x00007FF882386000-memory.dmp

                                                          Filesize

                                                          6.1MB

                                                          Download

                                                        • memory/264-46-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-44-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-42-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-41-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-38-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-37-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-25-0x00007FF8824C0000-0x00007FF8826E0000-memory.dmp

                                                          Filesize

                                                          2.1MB

                                                          Download

                                                        • memory/264-34-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-33-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-32-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-30-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-43-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-29-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-21-0x00007FF897160000-0x00007FF89789F000-memory.dmp

                                                          Filesize

                                                          7.2MB

                                                          Download

                                                        • memory/264-31-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/264-23-0x00007FF8824C0000-0x00007FF8826E0000-memory.dmp

                                                          Filesize

                                                          2.1MB

                                                          Download

                                                        • memory/264-24-0x00007FF8824C0000-0x00007FF8826E0000-memory.dmp

                                                          Filesize

                                                          2.1MB

                                                          Download

                                                        • memory/264-22-0x00007FF8824C0000-0x00007FF8826E0000-memory.dmp

                                                          Filesize

                                                          2.1MB

                                                          Download

                                                        • memory/264-27-0x00007FF8824C0000-0x00007FF8826E0000-memory.dmp

                                                          Filesize

                                                          2.1MB

                                                          Download

                                                        • memory/264-28-0x00007FF8980F0000-0x00007FF898291000-memory.dmp

                                                          Filesize

                                                          1.6MB

                                                          Download

                                                        • memory/264-20-0x00007FF897160000-0x00007FF89789F000-memory.dmp

                                                          Filesize

                                                          7.2MB

                                                          Download

                                                        • memory/264-26-0x00007FF8824C0000-0x00007FF8826E0000-memory.dmp

                                                          Filesize

                                                          2.1MB

                                                          Download

                                                        • memory/4332-92-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-94-0x00007FF881D90000-0x00007FF8823B6000-memory.dmp

                                                          Filesize

                                                          6.1MB

                                                          Download

                                                        • memory/4332-89-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-87-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-88-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-86-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-84-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-82-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-81-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-79-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-78-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-76-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-75-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-74-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-72-0x00007FF8980F0000-0x00007FF898291000-memory.dmp

                                                          Filesize

                                                          1.6MB

                                                          Download

                                                        • memory/4332-70-0x00007FF882560000-0x00007FF882780000-memory.dmp

                                                          Filesize

                                                          2.1MB

                                                          Download

                                                        • memory/4332-69-0x00007FF882560000-0x00007FF882780000-memory.dmp

                                                          Filesize

                                                          2.1MB

                                                          Download

                                                        • memory/4332-68-0x00007FF882560000-0x00007FF882780000-memory.dmp

                                                          Filesize

                                                          2.1MB

                                                          Download

                                                        • memory/4332-67-0x00007FF882560000-0x00007FF882780000-memory.dmp

                                                          Filesize

                                                          2.1MB

                                                          Download

                                                        • memory/4332-85-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-83-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-80-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-77-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-73-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-71-0x00007FF882560000-0x00007FF882780000-memory.dmp

                                                          Filesize

                                                          2.1MB

                                                          Download

                                                        • memory/4332-64-0x00007FF897160000-0x00007FF89789F000-memory.dmp

                                                          Filesize

                                                          7.2MB

                                                          Download

                                                        • memory/4332-98-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-91-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-90-0x00007FF6E49F0000-0x00007FF6E4E8D000-memory.dmp

                                                          Filesize

                                                          4.6MB

                                                          Download

                                                        • memory/4332-66-0x00007FF882560000-0x00007FF882780000-memory.dmp

                                                          Filesize

                                                          2.1MB

                                                          Download

                                                        • memory/4332-65-0x00007FF897160000-0x00007FF89789F000-memory.dmp

                                                          Filesize

                                                          7.2MB

                                                          Download