Overview

overview

10

Static

static

3

5fa128e617...6d.exe

windows7-x64

8

5fa128e617...6d.exe

windows10-2004-x64

10

Bygsukkere...ts.ps1

windows7-x64

3

Bygsukkere...ts.ps1

windows10-2004-x64

8

Analysis

  • max time kernel
    18s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-11-2024 01:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Bygsukkerets/Wanderlusts.ps1

  • Size

    52KB

  • MD5

    97c0731e8a832706f3f157e89ce3999b

  • SHA1

    8665ec5d2421bf666bd1bdc2b81876f582aa7a5d

  • SHA256

    e7d18aee03c79a8a55e2f0fc47ad0693c0bd5ba584b879c82624b4c80946b432

  • SHA512

    283ab18b29f488197daaeec4e7ddfc2b707e13c15c308c7f2b3b8bb492833e2a0bff70a5fe4ef5b2cce51830492785fc6c13a1eb69c60db39578dd5a39b78731

  • SSDEEP

    1536:ATz1EnqDuXf0VfLfTxv5P30atVCOKxoSbg5/StPv:ATZEnqDEf0VTfTxx30ecoQeS

Score
8/10
executionpersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 33 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 58 IoCs
  • Suspicious use of SendNotifyMessage 35 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Bygsukkerets\Wanderlusts.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4624
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:408
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4108
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4356
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3952
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2200
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1184
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
      PID:1468
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:5060
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3880
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:4628
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:336
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:428
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:3232
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:3648
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:2932
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:4352
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:4168
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4472
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:3948
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:4724
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:5016
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:2460
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:4712
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:2168
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:3232
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:1932
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:1336
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:2868
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:2428
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:3172
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:3664
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:1112
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:2612
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:1912
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:748
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:4948
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:4300
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:2216
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:3292
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:3588
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:1280
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:3752
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:2028
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:3664
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:2152
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:3400
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:2488
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:1436
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                        1⤵
                                                                                          PID:228
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:2152
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:3564
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                                PID:2640
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:4168
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:5032
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                    1⤵
                                                                                                      PID:5020
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:3752
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                          PID:748
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                            PID:3820
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:2324
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:2120
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                1⤵
                                                                                                                  PID:464
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:2804
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                    1⤵
                                                                                                                      PID:3608
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                      1⤵
                                                                                                                        PID:3664
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        explorer.exe
                                                                                                                        1⤵
                                                                                                                          PID:3480
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                          1⤵
                                                                                                                            PID:4108
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                            1⤵
                                                                                                                              PID:1048
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              explorer.exe
                                                                                                                              1⤵
                                                                                                                                PID:4352
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                1⤵
                                                                                                                                  PID:2940
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:1400
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:748
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                      1⤵
                                                                                                                                        PID:536
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:2488
                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                          explorer.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:2032
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                            1⤵
                                                                                                                                              PID:1168
                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                              1⤵
                                                                                                                                                PID:3728
                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                explorer.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:4904
                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                  1⤵
                                                                                                                                                    PID:4336
                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                    1⤵
                                                                                                                                                      PID:1680

                                                                                                                                                    Network

                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                    Replay Monitor

                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                    Downloads

                                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                                                      Filesize

                                                                                                                                                      471B

                                                                                                                                                      MD5

                                                                                                                                                      6b1dc3d19821301ca3e83d1053aa0b0b

                                                                                                                                                      SHA1

                                                                                                                                                      c4e4ee1cd06aeb47efdb96627ec0c088e8a096fd

                                                                                                                                                      SHA256

                                                                                                                                                      0f299895cc6ad40f61b0b09c49d7b362521b417ad9bc53df80d371c7cc0b0b22

                                                                                                                                                      SHA512

                                                                                                                                                      dd194f8cafe45cc19006a919bd758f1612e6f681cb79a3f96a245b18ab131e4278c1609a71f1b16850e80701bc9293a8595a196f083bb6a47eef11f5c573d93d

                                                                                                                                                      Download Submit

                                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                                                      Filesize

                                                                                                                                                      412B

                                                                                                                                                      MD5

                                                                                                                                                      aee206e4f041daba3a4840436d61c5b7

                                                                                                                                                      SHA1

                                                                                                                                                      9397a667342ac59a42bd55ad489fd096d1e538dd

                                                                                                                                                      SHA256

                                                                                                                                                      ebca37b43856626867215e5dadcd1889d91c0e19cb3be09ff7ff2485917390af

                                                                                                                                                      SHA512

                                                                                                                                                      c8894212bac8f99f75cdd68f006aa96e2f0d41c7730480bfcc560c71f53f696923a9de0b804cfdf7d7f446552a07599bedc3745b754a011cc9fa7c8a2fcbc4a3

                                                                                                                                                      Download Submit

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                                                      Filesize

                                                                                                                                                      2KB

                                                                                                                                                      MD5

                                                                                                                                                      3de3f0253ccf8f9966b2813f6aa6e613

                                                                                                                                                      SHA1

                                                                                                                                                      c19da9135a7bc7d4d6ed57a8c4a98e20e5da57a3

                                                                                                                                                      SHA256

                                                                                                                                                      1df88d31228c6d758a74a952d87d2028539cc412ffbdd39703940c174286799e

                                                                                                                                                      SHA512

                                                                                                                                                      80835ed5cba164d454de649cd545a8a63ee837145d069ff131b9fa48e75925247965d74cfd1157e5c220132800ac8c5708822d59035535abc47b496e41a95d00

                                                                                                                                                      Download Submit

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
                                                                                                                                                      Filesize

                                                                                                                                                      36KB

                                                                                                                                                      MD5

                                                                                                                                                      0e2a09c8b94747fa78ec836b5711c0c0

                                                                                                                                                      SHA1

                                                                                                                                                      92495421ad887f27f53784c470884802797025ad

                                                                                                                                                      SHA256

                                                                                                                                                      0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                                                                                                      SHA512

                                                                                                                                                      61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                                                                                                      Download Submit

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
                                                                                                                                                      Filesize

                                                                                                                                                      36KB

                                                                                                                                                      MD5

                                                                                                                                                      ab0262f72142aab53d5402e6d0cb5d24

                                                                                                                                                      SHA1

                                                                                                                                                      eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                                                                                                      SHA256

                                                                                                                                                      20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                                                                                                      SHA512

                                                                                                                                                      bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                                                                                                      Download Submit

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\80GI1ZH7\microsoft.windows[1].xml
                                                                                                                                                      Filesize

                                                                                                                                                      97B

                                                                                                                                                      MD5

                                                                                                                                                      742f1cda58883699ef753f83244412ce

                                                                                                                                                      SHA1

                                                                                                                                                      38531f396e1d9dc9ba6bba0604149c377605f57a

                                                                                                                                                      SHA256

                                                                                                                                                      5ef67927e9fdebb14515728d51548c52536519b35b5a52728ca1d660d957025f

                                                                                                                                                      SHA512

                                                                                                                                                      11acf77cd15052ae9cf554ab666f6c1e629e174fad16659738a11bee6a53b857f375fe99701e7c14c14286193864449f5b88a208ff34f4874e8351dff6a3a6f2

                                                                                                                                                      Download Submit

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_veyjke2b.qw0.ps1
                                                                                                                                                      Filesize

                                                                                                                                                      60B

                                                                                                                                                      MD5

                                                                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                      SHA1

                                                                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                      SHA256

                                                                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                      SHA512

                                                                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                      Download Submit

                                                                                                                                                    • memory/428-176-0x000001C1B0700000-0x000001C1B0800000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1024KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/428-180-0x000001C9B2840000-0x000001C9B2860000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/428-175-0x000001C1B0700000-0x000001C1B0800000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1024KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/428-192-0x000001C9B2800000-0x000001C9B2820000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/428-203-0x000001C9B2C10000-0x000001C9B2C30000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/748-1206-0x00000209F1400000-0x00000209F1420000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/748-1218-0x00000209F0FB0000-0x00000209F0FD0000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/748-1230-0x00000209F17C0000-0x00000209F17E0000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/748-1201-0x00000209F0300000-0x00000209F0400000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1024KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1112-1087-0x00000158F30A0000-0x00000158F30C0000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1112-1057-0x00000158F1B60000-0x00000158F1C60000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1024KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1112-1055-0x00000158F1B60000-0x00000158F1C60000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1024KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1112-1060-0x00000158F2AC0000-0x00000158F2AE0000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1112-1065-0x00000158F2A80000-0x00000158F2AA0000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1336-901-0x00000000042C0000-0x00000000042C1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1468-34-0x0000024153A20000-0x0000024153B20000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1024KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1468-68-0x0000024955E10000-0x0000024955E30000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1468-45-0x0000024955A00000-0x0000024955A20000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1468-39-0x0000024955A40000-0x0000024955A60000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1468-36-0x0000024153A20000-0x0000024153B20000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1024KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1468-35-0x0000024153A20000-0x0000024153B20000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1024KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1932-785-0x000001AD9E700000-0x000001AD9E720000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1932-760-0x000001AD9D200000-0x000001AD9D300000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1024KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1932-763-0x000001AD9E340000-0x000001AD9E360000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1932-758-0x000001AD9D200000-0x000001AD9D300000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1024KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1932-771-0x000001AD9E300000-0x000001AD9E320000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2168-757-0x0000000004740000-0x0000000004741000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2200-32-0x0000000004560000-0x0000000004561000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2216-1350-0x00000000023E0000-0x00000000023E1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2428-908-0x00000296C0530000-0x00000296C0550000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2428-935-0x00000296C0B00000-0x00000296C0B20000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2428-926-0x00000296C04F0000-0x00000296C0510000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2612-1199-0x00000000047F0000-0x00000000047F1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2932-317-0x00000225EE120000-0x00000225EE220000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1024KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2932-346-0x00000225EF650000-0x00000225EF670000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2932-330-0x00000225EF240000-0x00000225EF260000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2932-322-0x00000225EF280000-0x00000225EF2A0000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2932-318-0x00000225EE120000-0x00000225EE220000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1024KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/3172-1053-0x0000000003EC0000-0x0000000003EC1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/3232-315-0x0000000004220000-0x0000000004221000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/3588-1356-0x000001D2B6C00000-0x000001D2B6C20000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/3588-1359-0x000001D2B69B0000-0x000001D2B69D0000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/3588-1376-0x000001D2B6FC0000-0x000001D2B6FE0000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4352-460-0x0000000003360000-0x0000000003361000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4472-462-0x000001B643100000-0x000001B643200000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1024KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4472-490-0x000001B644600000-0x000001B644620000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4472-463-0x000001B643100000-0x000001B643200000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1024KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4472-467-0x000001B644240000-0x000001B644260000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4472-480-0x000001B644200000-0x000001B644220000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4624-14-0x000002A3BF4C0000-0x000002A3BF4E4000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      144KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4624-24-0x00007FFCA5843000-0x00007FFCA5845000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      8KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4624-1-0x000002A3A61D0000-0x000002A3A61F2000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      136KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4624-11-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      10.8MB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4624-27-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      10.8MB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4624-0-0x00007FFCA5843000-0x00007FFCA5845000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      8KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4624-25-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      10.8MB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4624-12-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      10.8MB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4624-19-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      10.8MB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4624-18-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      10.8MB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4624-16-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      10.8MB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4624-26-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      10.8MB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4624-15-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      10.8MB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4624-13-0x000002A3BF4C0000-0x000002A3BF4EA000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      168KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4628-173-0x0000000001440000-0x0000000001441000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4712-646-0x0000026FDBDF0000-0x0000026FDBE10000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4712-610-0x0000026FDA700000-0x0000026FDA800000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1024KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4712-609-0x0000026FDA700000-0x0000026FDA800000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1024KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4712-637-0x0000026FDB7E0000-0x0000026FDB800000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4712-611-0x0000026FDA700000-0x0000026FDA800000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1024KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4712-614-0x0000026FDBA20000-0x0000026FDBA40000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      128KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/5016-607-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download