Analysis

  • max time kernel
    38s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/03/2025, 06:02

General

  • Target

    Pericenter.ps1

  • Size

    53KB

  • MD5

    2d7a9b17a981757aeb3b8945b15bb897

  • SHA1

    7c27d9e5ce5ec9dfc5f13985769ca91698980e2a

  • SHA256

    7c7023149ea38184f67f040b8fac8f56804e7a84886678e7df8409354d3b0b7d

  • SHA512

    83370533553f6f55c644fc3b203c1e7e3572c69bc570776f0fbe79c146174fdfd3a037cf54c943222fd07d72fb0ac466b9154753adf4c5314a91ebfdbd8b2efe

  • SSDEEP

    1536:9pVgd3Kz6PAoQUUCuqfG2F9M15qJ3hLafjHcmM:9qKO4cnN59M15Ogg

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Enumerates connected drives 3 TTPs 14 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Pericenter.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4760
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2516
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3596
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4612
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4388
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5332
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:5424
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5480
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3788
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:4340
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2036
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3436
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:5700
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4364
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:5908
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5060
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4400
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1924
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2456
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4472
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:448
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:5200
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:4388
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:2084
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:1624
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3760
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:3144
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:5916
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:3100
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3572
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3476
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:1592
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:4392
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:5308
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:1684
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:1000
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:2456
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:4460
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:4200
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:2868
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:4400
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:6008
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:1940
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:4472
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:5444
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:4392
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:4272
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3512
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:3160
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3320
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:4024
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:3924
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:5764
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:3292
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:3160
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:1276
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:4232
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:4540
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:5416
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:5228
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:5744
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:6104
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:3880
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:1264
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:5232
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:4308
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:6040
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:5460
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:4088
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:5916
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:5192
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:5360
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:1332
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:2512
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:1648
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                1⤵
                                                                                                                  PID:5320
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:3564
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                    1⤵
                                                                                                                      PID:2596
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                      1⤵
                                                                                                                        PID:4532
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        explorer.exe
                                                                                                                        1⤵
                                                                                                                          PID:1516
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                          1⤵
                                                                                                                            PID:4120
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                            1⤵
                                                                                                                              PID:8
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              explorer.exe
                                                                                                                              1⤵
                                                                                                                                PID:2672
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                1⤵
                                                                                                                                  PID:4392
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:1924
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:5092
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                      1⤵
                                                                                                                                        PID:3636

                                                                                                                                      Network

                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                                                        Filesize

                                                                                                                                        471B

                                                                                                                                        MD5

                                                                                                                                        36614131e7d219481f6732e91c9f8eeb

                                                                                                                                        SHA1

                                                                                                                                        1019465753971aa2bfbc3fb0bb359d5cf7486070

                                                                                                                                        SHA256

                                                                                                                                        f7024fc4b0221b897a567d0cdd17096887adb04e42cb3747bb61bf7b602d2166

                                                                                                                                        SHA512

                                                                                                                                        2749cdc6fbfbbd3adcef2dd4dfd3f6094ceeeb74ee98abbe6e63a8b5c8f4ff91f8536acb53554203bbf81adf6225154f95b0a56779bf1f0107830d6866a543b1

                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                                                        Filesize

                                                                                                                                        412B

                                                                                                                                        MD5

                                                                                                                                        2b7b356ef62e7514932349e7a8556689

                                                                                                                                        SHA1

                                                                                                                                        89560b1123866e5c557f0fc41449182f0870ad52

                                                                                                                                        SHA256

                                                                                                                                        71852cb451fa9b21e6959d3534f8818d0c06761f1729a31f269f07b24eba92df

                                                                                                                                        SHA512

                                                                                                                                        fab4bf6d9a7436b320887db5eaba83869fe387202b8b0ef009f3356f192f72ae0de0493129c782e69b534b943fefee90e3ded39f8ca4e53bfac50a026ed0b477

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        a6333df1b70ff86a9cd8950d7d3ce616

                                                                                                                                        SHA1

                                                                                                                                        2f05cb2f7bb5a0ffdef8722eb2a4a6764c29188d

                                                                                                                                        SHA256

                                                                                                                                        e239e42f77bdbb8106e3f397aeeefc2bb1921b0dfbf5f26628eb36bb42e3bc1c

                                                                                                                                        SHA512

                                                                                                                                        22d86c848bb550d0acb3b7ede7379b9215af04b6110f23bc8e90cb1f26520461b229eb75d1c4994815213f8d8626231cc4a708163b6bc20a91c5b40e1f210ede

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15

                                                                                                                                        Filesize

                                                                                                                                        36KB

                                                                                                                                        MD5

                                                                                                                                        0e2a09c8b94747fa78ec836b5711c0c0

                                                                                                                                        SHA1

                                                                                                                                        92495421ad887f27f53784c470884802797025ad

                                                                                                                                        SHA256

                                                                                                                                        0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                                                                                        SHA512

                                                                                                                                        61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer

                                                                                                                                        Filesize

                                                                                                                                        36KB

                                                                                                                                        MD5

                                                                                                                                        ab0262f72142aab53d5402e6d0cb5d24

                                                                                                                                        SHA1

                                                                                                                                        eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                                                                                        SHA256

                                                                                                                                        20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                                                                                        SHA512

                                                                                                                                        bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133858873944997177.txt

                                                                                                                                        Filesize

                                                                                                                                        74KB

                                                                                                                                        MD5

                                                                                                                                        4627f8de255e0e8c0464c70eeff76d6a

                                                                                                                                        SHA1

                                                                                                                                        69d6ac86ff8ad0eab27457575ad5850db23948a4

                                                                                                                                        SHA256

                                                                                                                                        1ea3ac3675962792e3570616956b63aacb85dbd16290fa2788a9352730b30769

                                                                                                                                        SHA512

                                                                                                                                        541bb8480d90839e85afa5a3da7778a6f30ab47206a7158c8308583127348398e1b5dfac9bc278e0d44bba5d3fafc85b5c8e9f3dcbd4bbec6d7c980332b08ba8

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HQDQ62NL\microsoft.windows[1].xml

                                                                                                                                        Filesize

                                                                                                                                        97B

                                                                                                                                        MD5

                                                                                                                                        776938b51cc2c75d02233ab3d355aaf4

                                                                                                                                        SHA1

                                                                                                                                        0ecf5423dc20535d1a3b3431fc09850ddd4e51d3

                                                                                                                                        SHA256

                                                                                                                                        e31c2dbea08318e9ade7401a8363a77486d19e408ec8e4bf298dd5caff66beff

                                                                                                                                        SHA512

                                                                                                                                        5000b8c1e47442cc7acf633d2269cc541e2d7a2790c2b3991fd817d9dc824af171ecc0b7a4974bf2588f96714b11839fc54b689f0512c6993ac78caefa609830

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jzgjnwac.f5t.ps1

                                                                                                                                        Filesize

                                                                                                                                        60B

                                                                                                                                        MD5

                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                        SHA1

                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                        SHA256

                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                        SHA512

                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                      • memory/448-779-0x00000000047E0000-0x00000000047E1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/1592-1242-0x00000229209F0000-0x0000022920A10000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/1592-1215-0x000002291F500000-0x000002291F600000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1024KB

                                                                                                                                      • memory/1592-1214-0x000002291F500000-0x000002291F600000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1024KB

                                                                                                                                      • memory/1592-1218-0x0000022920620000-0x0000022920640000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/1592-1231-0x00000229205E0000-0x0000022920600000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/1684-1359-0x0000026E1F600000-0x0000026E1F700000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1024KB

                                                                                                                                      • memory/1684-1358-0x0000026E1F600000-0x0000026E1F700000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1024KB

                                                                                                                                      • memory/1924-635-0x0000000004A90000-0x0000000004A91000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/2084-918-0x0000000004320000-0x0000000004321000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/3100-1070-0x0000021FC9420000-0x0000021FC9520000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1024KB

                                                                                                                                      • memory/3100-1074-0x0000021FCA580000-0x0000021FCA5A0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/3100-1069-0x0000021FC9420000-0x0000021FC9520000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1024KB

                                                                                                                                      • memory/3100-1071-0x0000021FC9420000-0x0000021FC9520000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1024KB

                                                                                                                                      • memory/3100-1104-0x0000021FCA540000-0x0000021FCA560000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/3100-1105-0x0000021FCA990000-0x0000021FCA9B0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/3144-1067-0x0000000003F60000-0x0000000003F61000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/3436-358-0x000001EB052A0000-0x000001EB052C0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/3436-343-0x000001EB052E0000-0x000001EB05300000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/3436-338-0x000001EB04500000-0x000001EB04600000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1024KB

                                                                                                                                      • memory/3436-372-0x000001EB058C0000-0x000001EB058E0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/3436-340-0x000001EB04500000-0x000001EB04600000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1024KB

                                                                                                                                      • memory/3572-1211-0x0000000003EE0000-0x0000000003EE1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/3760-957-0x000002A4BDDD0000-0x000002A4BDDF0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/3760-939-0x000002A4BD7C0000-0x000002A4BD7E0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/3760-921-0x000002A4BC900000-0x000002A4BCA00000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1024KB

                                                                                                                                      • memory/3760-920-0x000002A4BC900000-0x000002A4BCA00000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1024KB

                                                                                                                                      • memory/3760-926-0x000002A4BDA00000-0x000002A4BDA20000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/3788-193-0x000001CF67200000-0x000001CF67300000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1024KB

                                                                                                                                      • memory/3788-209-0x000001CF68320000-0x000001CF68340000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/3788-197-0x000001CF68360000-0x000001CF68380000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/3788-194-0x000001CF67200000-0x000001CF67300000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1024KB

                                                                                                                                      • memory/3788-221-0x000001CF68730000-0x000001CF68750000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/4340-336-0x0000000004710000-0x0000000004711000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/4388-781-0x000001989F840000-0x000001989F940000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1024KB

                                                                                                                                      • memory/4388-786-0x000001A0A1990000-0x000001A0A19B0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/4388-799-0x000001A0A1950000-0x000001A0A1970000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/4388-810-0x000001A0A1D60000-0x000001A0A1D80000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/4392-1356-0x0000000004670000-0x0000000004671000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/4400-500-0x000002320F9C0000-0x000002320F9E0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/4400-488-0x000002320E900000-0x000002320EA00000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1024KB

                                                                                                                                      • memory/4400-493-0x000002320FA00000-0x000002320FA20000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/4400-525-0x000002320FDD0000-0x000002320FDF0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/4400-489-0x000002320E900000-0x000002320EA00000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1024KB

                                                                                                                                      • memory/4472-636-0x00000207C8B00000-0x00000207C8C00000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1024KB

                                                                                                                                      • memory/4472-664-0x00000207CA030000-0x00000207CA050000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/4472-641-0x00000207C9C60000-0x00000207C9C80000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/4472-653-0x00000207C9C20000-0x00000207C9C40000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/4612-30-0x0000000004E60000-0x0000000004E61000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/4760-19-0x00007FFF4FF00000-0x00007FFF509C1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/4760-14-0x00007FFF4FF00000-0x00007FFF509C1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/4760-2-0x0000019DFB2E0000-0x0000019DFB302000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        136KB

                                                                                                                                      • memory/4760-11-0x00007FFF4FF00000-0x00007FFF509C1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/4760-12-0x00007FFF4FF00000-0x00007FFF509C1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/4760-13-0x00007FFF4FF00000-0x00007FFF509C1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/4760-15-0x00007FFF4FF00000-0x00007FFF509C1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/4760-21-0x00007FFF4FF00000-0x00007FFF509C1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/4760-20-0x00007FFF4FF00000-0x00007FFF509C1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/4760-0-0x00007FFF4FF03000-0x00007FFF4FF05000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        8KB

                                                                                                                                      • memory/4760-16-0x0000019DFC0D0000-0x0000019DFC0FA000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        168KB

                                                                                                                                      • memory/4760-17-0x0000019DFC0D0000-0x0000019DFC0F4000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        144KB

                                                                                                                                      • memory/5332-31-0x000001CA50300000-0x000001CA50400000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        1024KB

                                                                                                                                      • memory/5332-36-0x000001CA51340000-0x000001CA51360000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/5332-62-0x000001CA51700000-0x000001CA51720000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/5332-49-0x000001CA51300000-0x000001CA51320000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        128KB

                                                                                                                                      • memory/5424-191-0x0000000003570000-0x0000000003571000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/5908-486-0x0000000004D20000-0x0000000004D21000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB