Overview

overview

10

Static

static

3

b9b72b3059...21.exe

windows7-x64

8

b9b72b3059...21.exe

windows10-2004-x64

10

Universite...de.ps1

windows7-x64

3

Universite...de.ps1

windows10-2004-x64

8

Analysis

  • max time kernel
    66s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/02/2025, 03:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Universitetsstuderende.ps1

  • Size

    53KB

  • MD5

    e4c90f84532e87a7be49136c6dedd496

  • SHA1

    3318b1654e28bb021204b89ed0074125ae449a8d

  • SHA256

    6313d40ac7f5dd82e268ccb8ecc0239f85d0e42fb7a484c6f6f94e644a6e36d7

  • SHA512

    3ab67b0b7f0a6f2d721e18bc6a962512dd7f58be6ef77602fa8508b357871f26f71a22cca7775132758e7774aab2473dc991cde17b62fedfe2c3c928a0db169e

  • SSDEEP

    1536:Lflo6h6Sdinsr7/AVs2yG0SGrIbmsynCDD:zlo6/f3Etyi3xD

Score
8/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 13 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Universitetsstuderende.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2404
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3836
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3664
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4376
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4960
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1128
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:4088
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3872
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:916
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4068
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3440
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4304
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4996
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4152
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3152
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4036
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5016
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:840
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3900
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4936
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3548
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4688
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3888
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUU2Q0E3RTItMjBCQy00MjVCLTgwNUItQzU1MjgwNzk0RThGfSIgdXNlcmlkPSJ7MjUwM0Q3NTQtMjI1RS00REU0LUE5MzctRDUzODUzMzhFNTVDfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NEZFRUFFQUQtMjVFOS00QzhBLTk5REUtNjMwMTk3RTA4QTBCfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI2IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDcxNzgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTY4MDM3MTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjgyNzYzMTQwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:836
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:4804
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3060
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1152
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3412
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1592
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4936
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3140
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1000
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1628
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2760
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4576
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Modifies registry class
    PID:2936
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3280
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
      PID:1428
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:4464
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:4476
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:440
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:2976
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:4524
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:3108
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:3868
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3556
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:4200
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:3616
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:2144
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:2756
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:4980
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:4064
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:3440
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:3156
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:2548
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:3668
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:1804
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:3432
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:1836
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:3700
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:1744
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:3536
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:3948
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:3180
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:4428
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:1472
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:3724
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:2212
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:800
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:4440
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:1932
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:3936
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:2832
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:5012
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:3852
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:2424
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:2440

                                                                                  Network

                                                                                  MITRE ATT&CK Enterprise v15

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                    Filesize

                                                                                    471B

                                                                                    MD5

                                                                                    9af7330d67b04b191f68437d8793badd

                                                                                    SHA1

                                                                                    615d72e1fea665e5e598c0836e0bd0e763d0de09

                                                                                    SHA256

                                                                                    edea49a04f5988c747a3da933db43d89ec96556729278bfdefd1257094055ccc

                                                                                    SHA512

                                                                                    d9d99756ae4b41102e79ab49a22b151412307249df1d5ef908157e49164766b45e8aa7c226ba40b69856bfaf2fca7d85010c289fd156b2ca7cd346e359300f55

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                    Filesize

                                                                                    412B

                                                                                    MD5

                                                                                    8a5464e951d5777c413b06bc357ec228

                                                                                    SHA1

                                                                                    ae38f7ad20ca60937b8f5679f9f7ea4cabf28f13

                                                                                    SHA256

                                                                                    4c68222c57e2e9bcb8c43022b6d8281d8546211b16109d8ad2a556e13372844b

                                                                                    SHA512

                                                                                    5c18aecfc68a38c1bb6830038e306d7dc447b8516e8c48679d203cf9b4f5d12ebb51d7f2619d101ecd912184bd3839d7b6a008096f8b5b6fe6dc4328734a0723

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                    Filesize

                                                                                    2KB

                                                                                    MD5

                                                                                    1258ac53dd3036aee6f6c202803e1fde

                                                                                    SHA1

                                                                                    6f56f1eeae3d5bd05fee1bb7598fbf48ae0f4829

                                                                                    SHA256

                                                                                    dae84cb8a97b58c07448fd97785ea70097a47e9c82a666d530ef268dd238e5e5

                                                                                    SHA512

                                                                                    0ded6da63acbe827202d7c81e5f7811593117166d113096a8aacd8b6fb65ce3fd9243b6ed2d60b33db96c74f0ef332b1320b76646da82a3fd966ab2f848d9141

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133839789315682587.txt
                                                                                    Filesize

                                                                                    75KB

                                                                                    MD5

                                                                                    fa754fb9e342a878ccecba9906d8bb6e

                                                                                    SHA1

                                                                                    49077564c02c35d08c7fa4c18e83bcdd9604e665

                                                                                    SHA256

                                                                                    6b48a2bb1a17c137124760a3ea3ef932c32318a245732ed17bcea23515c78166

                                                                                    SHA512

                                                                                    60bf06b0f2ffa7d01119e1898a3a326f8b59d97ad852ac638722458a1b9f73354b7e75979d0f6bb327e97d8224e2a7093d23c77b85fc5b322501ffd309ac3aff

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\SUL4O2S6\microsoft.windows[1].xml
                                                                                    Filesize

                                                                                    97B

                                                                                    MD5

                                                                                    627277ae709ad8279576f0852ae0b9af

                                                                                    SHA1

                                                                                    e8dd26679e20cdf1a526d49d10c5d08bb3fdc6a2

                                                                                    SHA256

                                                                                    dfc53a00a31d242c261e6026a692a7b2b8ad134414ffe45956edd3e074720055

                                                                                    SHA512

                                                                                    f6134fefafe953abd5ccc5f4ad1bb0ed667dc4fcf3449d669f0b2b76019621549eb8bb673e7721092989a3d05e1db071f654136ada6a46e0eb61d30967b549cc

                                                                                    Download Submit

                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xbjz4uia.id3.ps1
                                                                                    Filesize

                                                                                    60B

                                                                                    MD5

                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                    SHA1

                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                    SHA256

                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                    SHA512

                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                    Download Submit

                                                                                  • memory/440-1351-0x00000000043B0000-0x00000000043B1000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/840-470-0x0000000004F10000-0x0000000004F11000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/916-174-0x0000000003650000-0x0000000003651000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/1128-67-0x000001C675A00000-0x000001C675A20000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/1128-46-0x000001C675600000-0x000001C675620000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/1128-36-0x000001C675640000-0x000001C675660000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/1128-32-0x000001C674500000-0x000001C674600000-memory.dmp

                                                                                    Filesize

                                                                                    1024KB

                                                                                    Download

                                                                                  • memory/1128-31-0x000001C674500000-0x000001C674600000-memory.dmp

                                                                                    Filesize

                                                                                    1024KB

                                                                                    Download

                                                                                  • memory/1152-774-0x00000169CA400000-0x00000169CA500000-memory.dmp

                                                                                    Filesize

                                                                                    1024KB

                                                                                    Download

                                                                                  • memory/1152-773-0x00000169CA400000-0x00000169CA500000-memory.dmp

                                                                                    Filesize

                                                                                    1024KB

                                                                                    Download

                                                                                  • memory/1152-787-0x00000169CB500000-0x00000169CB520000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/1152-795-0x00000169CB910000-0x00000169CB930000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/1152-778-0x00000169CB540000-0x00000169CB560000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/1428-1212-0x000001A4AE000000-0x000001A4AE100000-memory.dmp

                                                                                    Filesize

                                                                                    1024KB

                                                                                    Download

                                                                                  • memory/1428-1214-0x000001A4AE000000-0x000001A4AE100000-memory.dmp

                                                                                    Filesize

                                                                                    1024KB

                                                                                    Download

                                                                                  • memory/1428-1217-0x000001A4AF160000-0x000001A4AF180000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/1428-1213-0x000001A4AE000000-0x000001A4AE100000-memory.dmp

                                                                                    Filesize

                                                                                    1024KB

                                                                                    Download

                                                                                  • memory/1428-1235-0x000001A4AF530000-0x000001A4AF550000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/1428-1225-0x000001A4AF120000-0x000001A4AF140000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/1628-1059-0x0000025ECFC20000-0x0000025ECFD20000-memory.dmp

                                                                                    Filesize

                                                                                    1024KB

                                                                                    Download

                                                                                  • memory/1628-1096-0x0000025ED1140000-0x0000025ED1160000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/1628-1060-0x0000025ECFC20000-0x0000025ECFD20000-memory.dmp

                                                                                    Filesize

                                                                                    1024KB

                                                                                    Download

                                                                                  • memory/1628-1064-0x0000025ED0D70000-0x0000025ED0D90000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/1628-1074-0x0000025ED0D30000-0x0000025ED0D50000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/2404-12-0x00007FF847230000-0x00007FF847CF1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                    Download

                                                                                  • memory/2404-11-0x00007FF847230000-0x00007FF847CF1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                    Download

                                                                                  • memory/2404-13-0x00007FF847230000-0x00007FF847CF1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                    Download

                                                                                  • memory/2404-14-0x00007FF847230000-0x00007FF847CF1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                    Download

                                                                                  • memory/2404-15-0x00007FF847230000-0x00007FF847CF1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                    Download

                                                                                  • memory/2404-16-0x000001B758640000-0x000001B75866A000-memory.dmp

                                                                                    Filesize

                                                                                    168KB

                                                                                    Download

                                                                                  • memory/2404-20-0x00007FF847230000-0x00007FF847CF1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                    Download

                                                                                  • memory/2404-21-0x00007FF847230000-0x00007FF847CF1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                    Download

                                                                                  • memory/2404-1-0x000001B7560B0000-0x000001B7560D2000-memory.dmp

                                                                                    Filesize

                                                                                    136KB

                                                                                    Download

                                                                                  • memory/2404-19-0x00007FF847230000-0x00007FF847CF1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                    Download

                                                                                  • memory/2404-0-0x00007FF847233000-0x00007FF847235000-memory.dmp

                                                                                    Filesize

                                                                                    8KB

                                                                                    Download

                                                                                  • memory/2404-17-0x000001B758640000-0x000001B758664000-memory.dmp

                                                                                    Filesize

                                                                                    144KB

                                                                                    Download

                                                                                  • memory/2756-1523-0x000001702B920000-0x000001702B940000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/2756-1511-0x000001702B960000-0x000001702B980000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/2936-1210-0x0000000004660000-0x0000000004661000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/3140-1058-0x0000000004390000-0x0000000004391000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/3412-922-0x0000000003530000-0x0000000003531000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/3440-178-0x0000028BD2600000-0x0000028BD2700000-memory.dmp

                                                                                    Filesize

                                                                                    1024KB

                                                                                    Download

                                                                                  • memory/3440-193-0x0000028BD34F0000-0x0000028BD3510000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/3440-213-0x0000028BD3B00000-0x0000028BD3B20000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/3440-182-0x0000028BD3530000-0x0000028BD3550000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/3548-622-0x0000000003F10000-0x0000000003F11000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/3616-1504-0x0000000004B80000-0x0000000004B81000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/3888-629-0x00000228689B0000-0x00000228689D0000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/3888-643-0x0000022868970000-0x0000022868990000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/3888-624-0x0000022867850000-0x0000022867950000-memory.dmp

                                                                                    Filesize

                                                                                    1024KB

                                                                                    Download

                                                                                  • memory/3888-661-0x0000022868D80000-0x0000022868DA0000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/4152-366-0x00000259B03B0000-0x00000259B03D0000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/4152-334-0x00000259AFFE0000-0x00000259B0000000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/4152-331-0x00000259AEF00000-0x00000259AF000000-memory.dmp

                                                                                    Filesize

                                                                                    1024KB

                                                                                    Download

                                                                                  • memory/4152-330-0x00000259AEF00000-0x00000259AF000000-memory.dmp

                                                                                    Filesize

                                                                                    1024KB

                                                                                    Download

                                                                                  • memory/4152-346-0x00000259AFFA0000-0x00000259AFFC0000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/4304-327-0x0000000004C30000-0x0000000004C31000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/4376-29-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/4524-1370-0x000001CC8F800000-0x000001CC8F820000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/4524-1359-0x000001CC8F840000-0x000001CC8F860000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/4524-1390-0x000001CC8FC10000-0x000001CC8FC30000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/4804-772-0x0000000004760000-0x0000000004761000-memory.dmp

                                                                                    Filesize

                                                                                    4KB

                                                                                    Download

                                                                                  • memory/4936-937-0x00000197B05E0000-0x00000197B0600000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/4936-477-0x000001D92B320000-0x000001D92B340000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/4936-489-0x000001D92AFE0000-0x000001D92B000000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/4936-509-0x000001D92B6F0000-0x000001D92B710000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/4936-946-0x00000197B0BF0000-0x00000197B0C10000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/4936-928-0x00000197B0820000-0x00000197B0840000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                    Download

                                                                                  • memory/4936-924-0x00000197AF700000-0x00000197AF800000-memory.dmp

                                                                                    Filesize

                                                                                    1024KB

                                                                                    Download

                                                                                  • memory/4936-923-0x00000197AF700000-0x00000197AF800000-memory.dmp

                                                                                    Filesize

                                                                                    1024KB

                                                                                    Download