Overview

overview

10

Static

static

1

MRP00108 &...87.rar

windows7-x64

1

MRP00108 &...87.rar

windows10-2004-x64

1

MRP00108 &...87.exe

windows7-x64

4

MRP00108 &...87.exe

windows10-2004-x64

10

Filterintegration.ps1

windows7-x64

3

Filterintegration.ps1

windows10-2004-x64

8

Analysis

  • max time kernel
    60s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-12-2024 08:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Filterintegration.ps1

  • Size

    52KB

  • MD5

    b2675a19c8907bdb1caac87a463036ab

  • SHA1

    ce3eb4761dd92a88834851e404952edebac92ff3

  • SHA256

    e55feb751d85c738f96c802c9df5af30ef0722a0af003bdc65826f31c2d0b9cd

  • SHA512

    5d0707af18e5e0790c48c33ab62869cdbba3662de10850368b8a0ad1511896a29ce6f7b1d1daaa45876ce83873d8cef1df592092c07615e7a72dd5d3620a95b4

  • SSDEEP

    768:DfV6aJ4eYCDeA0vC8w56zGmZJCLFm/EHXda1My4bDEh91kQAxKzeWSVlsIkgQSiN:DfV6k4XLK8S6XHENa12bYkQAxK+VlTdG

Score
8/10
executionpersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 13 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 20 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Filterintegration.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1728
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1368
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2680
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4756
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4324
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4144
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of SendNotifyMessage
    PID:4192
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3672
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2464
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:4352
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2100
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:336
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4632
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3404
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3788
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4584
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4028
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3288
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3484
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3200
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4152
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3496
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2940
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:456
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4160
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2256
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:3424
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4152
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4932
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3128
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5012
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1648
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3736
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3992
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3564
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    PID:4872
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:4012
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:3800
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:3444
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:4516
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:4196
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:1332
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:1500
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:1840
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:4084
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:4552
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:1556
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:2016
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:2500
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:1896
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:3480
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:3528
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:3892
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:1536
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:3748
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:1192
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:4152
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:1872
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:2680
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:3456
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:4068
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:1984
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3976
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:2880
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:2920
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:1560
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:2988
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:3004
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:3880
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:3772
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:4728
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:2772
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:3052
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:4792
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:4552
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:3204
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:3956
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:1380
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:1648
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:4160
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:2956
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:4632
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:464
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:4152
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:1064
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:4576
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:3676
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:3884
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:4052
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:4092
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                1⤵
                                                                                                                  PID:632

                                                                                                                Network

                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                Replay Monitor

                                                                                                                Loading Replay Monitor...

                                                                                                                Downloads

                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                  Filesize

                                                                                                                  471B

                                                                                                                  MD5

                                                                                                                  c776bc45c99b7007a11f27524a5637e3

                                                                                                                  SHA1

                                                                                                                  d41c9f87705bab776522ce534ae9bb70dfe8a567

                                                                                                                  SHA256

                                                                                                                  acb01938e3b78ab47bb8c9cfccd4bd37e9091ac0c3a521568711eb2941870847

                                                                                                                  SHA512

                                                                                                                  d3350cf478adb3431db65d76f4b872954b2ba99a40f21c4925279f5193aa1f22f72228d4e2231fcef3782292c1021dab64bac3601bc22dfbc0fb7a1354d1068f

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                  Filesize

                                                                                                                  412B

                                                                                                                  MD5

                                                                                                                  b433dcc82b10fc3f5e3bebbf878cad3b

                                                                                                                  SHA1

                                                                                                                  d5a99f60bc67521691e38e58aa9c7e648f75c7c3

                                                                                                                  SHA256

                                                                                                                  9e9e86b31e53d88d00e8877671a6837850e4056a27761a8d7c5398f98de35c6c

                                                                                                                  SHA512

                                                                                                                  32a0dc97692d0f36135d3b687a5f4e20eb98267a245305670e5ee652ea05d55834c622eee5f35d47f976a5a6e98b7cd1b67c7ed14c01bdec66497316f65f49b7

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                  Filesize

                                                                                                                  2KB

                                                                                                                  MD5

                                                                                                                  7f382ca8c8464d450337196f6440453a

                                                                                                                  SHA1

                                                                                                                  dcb50677bbb78b0700d8b455902e4b85c4e7db3d

                                                                                                                  SHA256

                                                                                                                  b549ab508cb1909f754249b62df04f96578b360a709cc562ebad51419e233b59

                                                                                                                  SHA512

                                                                                                                  749e26e302ff0bcae6ce3e6acf81cfd39f74d1dd75c3f5251aee0accd16341b5cc108f72d783e9894c7c512b5fee7e1e19e7039a155df666a97d92b7439e63a8

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
                                                                                                                  Filesize

                                                                                                                  36KB

                                                                                                                  MD5

                                                                                                                  0e2a09c8b94747fa78ec836b5711c0c0

                                                                                                                  SHA1

                                                                                                                  92495421ad887f27f53784c470884802797025ad

                                                                                                                  SHA256

                                                                                                                  0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                                                                  SHA512

                                                                                                                  61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
                                                                                                                  Filesize

                                                                                                                  36KB

                                                                                                                  MD5

                                                                                                                  ab0262f72142aab53d5402e6d0cb5d24

                                                                                                                  SHA1

                                                                                                                  eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                                                                  SHA256

                                                                                                                  20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                                                                  SHA512

                                                                                                                  bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\YOZOSN6K\microsoft.windows[1].xml
                                                                                                                  Filesize

                                                                                                                  97B

                                                                                                                  MD5

                                                                                                                  e6ba99d8293b4c7951bad0a2c6761b8e

                                                                                                                  SHA1

                                                                                                                  87aaf2d975cdef4db219e4f9f2b1469dd05a6b0b

                                                                                                                  SHA256

                                                                                                                  773b2b8b752a5bfd3d93b7475dbb7f659bad014ffd06292ee0450c216892ac29

                                                                                                                  SHA512

                                                                                                                  e6861e87688861f4c43d80f9e98996fc476a11d4e147eb3c55f66d6f1abc065690e2662dd34dca32c0284b64056b95142d932697aa1fa6d6b755ef0f57031ee0

                                                                                                                  Download Submit

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xy0lquyt.2sd.ps1
                                                                                                                  Filesize

                                                                                                                  60B

                                                                                                                  MD5

                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                  SHA1

                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                  SHA256

                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                  SHA512

                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                  Download Submit

                                                                                                                • memory/336-372-0x000001B74D9D0000-0x000001B74D9F0000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/336-335-0x000001B74C300000-0x000001B74C400000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1024KB

                                                                                                                  Download

                                                                                                                • memory/336-336-0x000001B74C300000-0x000001B74C400000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1024KB

                                                                                                                  Download

                                                                                                                • memory/336-337-0x000001B74C300000-0x000001B74C400000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1024KB

                                                                                                                  Download

                                                                                                                • memory/336-340-0x000001B74D600000-0x000001B74D620000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/336-371-0x000001B74D3C0000-0x000001B74D3E0000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/456-914-0x0000000004890000-0x0000000004891000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/1648-1223-0x0000016A6D400000-0x0000016A6D420000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/1648-1209-0x0000016A6C300000-0x0000016A6C400000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1024KB

                                                                                                                  Download

                                                                                                                • memory/1648-1236-0x0000016A6D810000-0x0000016A6D830000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/1648-1214-0x0000016A6D440000-0x0000016A6D460000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/1648-1210-0x0000016A6C300000-0x0000016A6C400000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1024KB

                                                                                                                  Download

                                                                                                                • memory/1728-0-0x00007FFE4CDD3000-0x00007FFE4CDD5000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                  Download

                                                                                                                • memory/1728-16-0x00000204D6A20000-0x00000204D6A44000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  144KB

                                                                                                                  Download

                                                                                                                • memory/1728-11-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  10.8MB

                                                                                                                  Download

                                                                                                                • memory/1728-19-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  10.8MB

                                                                                                                  Download

                                                                                                                • memory/1728-12-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  10.8MB

                                                                                                                  Download

                                                                                                                • memory/1728-20-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  10.8MB

                                                                                                                  Download

                                                                                                                • memory/1728-13-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  10.8MB

                                                                                                                  Download

                                                                                                                • memory/1728-18-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  10.8MB

                                                                                                                  Download

                                                                                                                • memory/1728-14-0x00007FFE4CDD0000-0x00007FFE4D891000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  10.8MB

                                                                                                                  Download

                                                                                                                • memory/1728-15-0x00000204D6A20000-0x00000204D6A4A000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  168KB

                                                                                                                  Download

                                                                                                                • memory/1728-1-0x00000204D6850000-0x00000204D6872000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  136KB

                                                                                                                  Download

                                                                                                                • memory/2256-953-0x000002B414EC0000-0x000002B414EE0000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/2256-933-0x000002B4148B0000-0x000002B4148D0000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/2256-922-0x000002B4148F0000-0x000002B414910000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/2256-916-0x000002B413A00000-0x000002B413B00000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1024KB

                                                                                                                  Download

                                                                                                                • memory/2464-202-0x0000021894800000-0x0000021894820000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/2464-191-0x0000021894840000-0x0000021894860000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/2464-220-0x0000021894C10000-0x0000021894C30000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/2940-797-0x0000021397880000-0x00000213978A0000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/2940-805-0x0000021397C90000-0x0000021397CB0000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/2940-783-0x00000213978C0000-0x00000213978E0000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/3128-1207-0x0000000004880000-0x0000000004881000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/3288-631-0x000001A04FBA0000-0x000001A04FBC0000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/3288-662-0x000001A04FF70000-0x000001A04FF90000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/3288-646-0x000001A04FB60000-0x000001A04FB80000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/3424-1059-0x0000000004C80000-0x0000000004C81000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/3564-1354-0x000002774FA00000-0x000002774FB00000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1024KB

                                                                                                                  Download

                                                                                                                • memory/3564-1355-0x000002774FA00000-0x000002774FB00000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1024KB

                                                                                                                  Download

                                                                                                                • memory/3564-1359-0x0000027750890000-0x00000277508B0000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/3564-1391-0x00000277509E0000-0x0000027750A00000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/3564-1389-0x0000027750850000-0x0000027750870000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/3736-1352-0x0000000002C50000-0x0000000002C51000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/3788-514-0x0000023BC7C10000-0x0000023BC7C30000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/3788-492-0x0000023BC7800000-0x0000023BC7820000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/3788-483-0x0000023BC7840000-0x0000023BC7860000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/3800-1495-0x00000233F2200000-0x00000233F2300000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1024KB

                                                                                                                  Download

                                                                                                                • memory/3800-1508-0x00000233F3320000-0x00000233F3340000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/3800-1498-0x00000233F3360000-0x00000233F3380000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/3800-1493-0x00000233F2200000-0x00000233F2300000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1024KB

                                                                                                                  Download

                                                                                                                • memory/3800-1494-0x00000233F2200000-0x00000233F2300000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1024KB

                                                                                                                  Download

                                                                                                                • memory/4144-53-0x000001BA1CC30000-0x000001BA1CC50000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/4144-31-0x000001BA1B840000-0x000001BA1B940000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1024KB

                                                                                                                  Download

                                                                                                                • memory/4144-35-0x000001BA1C860000-0x000001BA1C880000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/4144-42-0x000001BA1C820000-0x000001BA1C840000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/4144-32-0x000001BA1B840000-0x000001BA1B940000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1024KB

                                                                                                                  Download

                                                                                                                • memory/4144-30-0x000001BA1B840000-0x000001BA1B940000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1024KB

                                                                                                                  Download

                                                                                                                • memory/4152-776-0x0000000002F20000-0x0000000002F21000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4192-183-0x0000000004B80000-0x0000000004B81000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4352-334-0x0000000003FB0000-0x0000000003FB1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4584-624-0x0000000004870000-0x0000000004871000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4632-475-0x0000000003F70000-0x0000000003F71000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4756-28-0x0000000004600000-0x0000000004601000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4872-1491-0x0000000004840000-0x0000000004841000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  Download

                                                                                                                • memory/4932-1066-0x000001ABCBF10000-0x000001ABCBF30000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/4932-1087-0x000001ABCC4E0000-0x000001ABCC500000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download

                                                                                                                • memory/4932-1061-0x000001ABCB000000-0x000001ABCB100000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  1024KB

                                                                                                                  Download

                                                                                                                • memory/4932-1072-0x000001ABCBED0000-0x000001ABCBEF0000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                  Download