Analysis

  • max time kernel
    39s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250619-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/07/2025, 06:52

General

  • Target

    Eksportindustrien.ps1

  • Size

    54KB

  • MD5

    e9e3dfcb65a6f62522714916d1ccd491

  • SHA1

    09319cafa05d6f9fb66e11c6ac3c41046b28e9e0

  • SHA256

    7beab23f05657b7b773b6e6facccfcc81bdde6bbc7a23c435b4a5b8e94674e2e

  • SHA512

    df3999ee5e66db05047989d1c50546bf256bab29bf850985bf89de3aef9b7a3445c7ac1db199a8b22e6b347f0db6e2fc813770b67c14dcc8d12ef4e72332f055

  • SSDEEP

    1536:TK2MNrH82wxdRFew8ACyLqzkK26AgV4VDBs:OfNBwBI9ACyLqYeZKs

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Enumerates connected drives 3 TTPs 16 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Eksportindustrien.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4912
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4884
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5520
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2108
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2144
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2668
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:5316
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5620
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4352
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:2508
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3492
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1976
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:1752
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1992
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:5812
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2020
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3920
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1180
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2116
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2332
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:5504
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3720
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4164
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:1460
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:6052
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:2116
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:5564
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:5620
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:1500
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:5452
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:5952
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:4436
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3348
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3224
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:4504
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:1508
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:2332
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:1448
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:1660
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:4072
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:3088
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:3432
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:4912
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:5952
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:3824
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:1692
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:5700
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4736
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:1544
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:2336
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:4012
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:3800
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:1908
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:2916
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:2968
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:1436
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:2872
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:5780
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:3980
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:4736
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:5668
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:3556
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:2912
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:5328
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:4740
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:1368
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:3828
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:4532
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:6076
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:5128
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:1660
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:1152
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:4892
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:1820
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:4360
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:5096
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                            1⤵
                                                                                                              PID:4720
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:6004
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                1⤵
                                                                                                                  PID:5036
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                  1⤵
                                                                                                                    PID:4316
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:3824
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                      1⤵
                                                                                                                        PID:832
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                        1⤵
                                                                                                                          PID:3928
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe
                                                                                                                          1⤵
                                                                                                                            PID:3800
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                            1⤵
                                                                                                                              PID:4580
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                              1⤵
                                                                                                                                PID:2636
                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                explorer.exe
                                                                                                                                1⤵
                                                                                                                                  PID:2396
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:4236
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:4736
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      explorer.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:3824
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:2020
                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                          1⤵
                                                                                                                                            PID:5380

                                                                                                                                          Network

                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                                                                  Filesize

                                                                                                                                                  471B

                                                                                                                                                  MD5

                                                                                                                                                  3ef39b791de2c639ea3f827068b6a875

                                                                                                                                                  SHA1

                                                                                                                                                  828ff318380258836ffa989c665d8e3d71a76fc9

                                                                                                                                                  SHA256

                                                                                                                                                  9635cf402e7e153b4398740dd15077ca7b1df339d62e92b8317b4078679fb5d3

                                                                                                                                                  SHA512

                                                                                                                                                  a5864fee2b4c73533dbd155b6a899109bb3c122b90d8d06d243ba5775ea41593bf14363eb247d9779d5fec752904ce0a416af9fdef4f8bdaf9180750c03275e4

                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                                                                  Filesize

                                                                                                                                                  412B

                                                                                                                                                  MD5

                                                                                                                                                  cbd1f0ea0eabcc1f85ebbb417a101257

                                                                                                                                                  SHA1

                                                                                                                                                  72831e5e5d6ea6e5e1615e31d0304aaeb253923a

                                                                                                                                                  SHA256

                                                                                                                                                  fde7384fa165fc6a5d77513963a662c00cce6b29fc0ca3798efecc7243fc1d8c

                                                                                                                                                  SHA512

                                                                                                                                                  337c3f5ff2b38054336fa2e61ac4494e733404d01e72f6503172afde746a47ef5bb6e318d13c33fe55cead25bf30a8700bf97a1dc6abbaa12e0b93e6fcd4fb38

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  aefca8831f9a756b85ce813b489ea1a1

                                                                                                                                                  SHA1

                                                                                                                                                  3f45d2aa8d3c9e4b9413f9b129212e1b5304267c

                                                                                                                                                  SHA256

                                                                                                                                                  ba1a6e47dd1bf9d008924803ff97482e32fe9b51d96965c7a191eb20ce7614b4

                                                                                                                                                  SHA512

                                                                                                                                                  3bd840db902e9c023e943ffe33dde044cd01f8c8f8c3415bf1ca1c79e0659f742eb4a96c787d1506286eaaec9c9e7f3e88a6af0eb03d38c08027f043e3cc3aea

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15

                                                                                                                                                  Filesize

                                                                                                                                                  36KB

                                                                                                                                                  MD5

                                                                                                                                                  0e2a09c8b94747fa78ec836b5711c0c0

                                                                                                                                                  SHA1

                                                                                                                                                  92495421ad887f27f53784c470884802797025ad

                                                                                                                                                  SHA256

                                                                                                                                                  0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                                                                                                  SHA512

                                                                                                                                                  61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer

                                                                                                                                                  Filesize

                                                                                                                                                  36KB

                                                                                                                                                  MD5

                                                                                                                                                  ab0262f72142aab53d5402e6d0cb5d24

                                                                                                                                                  SHA1

                                                                                                                                                  eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                                                                                                  SHA256

                                                                                                                                                  20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                                                                                                  SHA512

                                                                                                                                                  bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133958263475256348.txt

                                                                                                                                                  Filesize

                                                                                                                                                  84KB

                                                                                                                                                  MD5

                                                                                                                                                  1081b612a429010a4f553e49ed505e76

                                                                                                                                                  SHA1

                                                                                                                                                  146b8a6a91ff7133b8f6571d160754df12a57b60

                                                                                                                                                  SHA256

                                                                                                                                                  6a3f79863188c5564707282cfa7369285a938fe5a25b52c5b1d1ff1b6201cb02

                                                                                                                                                  SHA512

                                                                                                                                                  1cf054092d0c9bb58dfaaf5f8a3530e2cdeb97b78ca76c098499aa0e877e621c89b0f337339b404c72e4a1ee5d95ce14f4d2f3e83d66f53bf874d59f7c730d14

                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZKFFUKFI\microsoft.windows[1].xml

                                                                                                                                                  Filesize

                                                                                                                                                  97B

                                                                                                                                                  MD5

                                                                                                                                                  26c32de0768fc61226a514bd1397b6aa

                                                                                                                                                  SHA1

                                                                                                                                                  a731866647c0c3515a0b5c3513b55989a096367e

                                                                                                                                                  SHA256

                                                                                                                                                  f99e7062077f3841d3479451fdda22e4d7022fe3f6919fafc783d44f4d9aa04c

                                                                                                                                                  SHA512

                                                                                                                                                  059cdc61c350d1c08177ca634bdd87b8cb55d1da335adfc1faabf767e6f8f8b7f11cf1be31d4ccd016accd01b0e4e7e3073d181d93c77501327f51caf41e1f41

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kbpwwfik.wh0.ps1

                                                                                                                                                  Filesize

                                                                                                                                                  60B

                                                                                                                                                  MD5

                                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                  SHA1

                                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                  SHA256

                                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                  SHA512

                                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                • memory/1180-623-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/1448-1520-0x000002A1107E0000-0x000002A110800000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/1448-1532-0x000002A1107A0000-0x000002A1107C0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/1448-1551-0x000002A110BB0000-0x000002A110BD0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/1460-920-0x0000000004200000-0x0000000004201000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/1500-1074-0x000002B55F700000-0x000002B55F720000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/1500-1085-0x000002B55F3B0000-0x000002B55F3D0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/1500-1105-0x000002B55FAC0000-0x000002B55FAE0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/1508-1512-0x0000000004170000-0x0000000004171000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/1660-1660-0x0000000004B50000-0x0000000004B51000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/1976-333-0x0000022AD3F00000-0x0000022AD4000000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1024KB

                                                                                                                                                • memory/1976-349-0x0000022AD5020000-0x0000022AD5040000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/1976-360-0x0000022AD5420000-0x0000022AD5440000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/1976-338-0x0000022AD5060000-0x0000022AD5080000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/1976-334-0x0000022AD3F00000-0x0000022AD4000000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1024KB

                                                                                                                                                • memory/2108-28-0x00000000034A0000-0x00000000034A1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/2116-947-0x0000020380770000-0x0000020380790000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/2116-922-0x000002037F240000-0x000002037F340000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1024KB

                                                                                                                                                • memory/2116-927-0x00000203803A0000-0x00000203803C0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/2116-936-0x0000020380360000-0x0000020380380000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/2332-653-0x000001E04D440000-0x000001E04D460000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/2332-624-0x000001E04C320000-0x000001E04C420000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1024KB

                                                                                                                                                • memory/2332-626-0x000001E04C320000-0x000001E04C420000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1024KB

                                                                                                                                                • memory/2332-625-0x000001E04C320000-0x000001E04C420000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1024KB

                                                                                                                                                • memory/2332-629-0x000001E04D480000-0x000001E04D4A0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/2332-661-0x000001E04D850000-0x000001E04D870000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/2508-331-0x00000000048B0000-0x00000000048B1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/2668-65-0x000001EC67170000-0x000001EC67190000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/2668-34-0x000001EC66DA0000-0x000001EC66DC0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/2668-30-0x000001EC65D70000-0x000001EC65E70000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1024KB

                                                                                                                                                • memory/2668-29-0x000001EC65D70000-0x000001EC65E70000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1024KB

                                                                                                                                                • memory/2668-54-0x000001EC66D60000-0x000001EC66D80000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/3088-1668-0x00000232EC960000-0x00000232EC980000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/3348-1361-0x0000000004180000-0x0000000004181000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/3920-485-0x0000027369C80000-0x0000027369CA0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/3920-496-0x000002736A2A0000-0x000002736A2C0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/3920-477-0x0000027369CC0000-0x0000027369CE0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/3920-473-0x0000027368D60000-0x0000027368E60000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1024KB

                                                                                                                                                • memory/3920-472-0x0000027368D60000-0x0000027368E60000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1024KB

                                                                                                                                                • memory/4164-788-0x0000015183890000-0x00000151838B0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/4164-810-0x0000015183EA0000-0x0000015183EC0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/4164-773-0x0000015182B00000-0x0000015182C00000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1024KB

                                                                                                                                                • memory/4164-774-0x0000015182B00000-0x0000015182C00000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1024KB

                                                                                                                                                • memory/4164-778-0x00000151838D0000-0x00000151838F0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/4352-196-0x000001CBD0400000-0x000001CBD0500000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1024KB

                                                                                                                                                • memory/4352-195-0x000001CBD0400000-0x000001CBD0500000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1024KB

                                                                                                                                                • memory/4352-209-0x000001CBD0FC0000-0x000001CBD0FE0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/4352-220-0x000001CBD18E0000-0x000001CBD1900000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/4352-199-0x000001CBD1300000-0x000001CBD1320000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/4352-194-0x000001CBD0400000-0x000001CBD0500000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1024KB

                                                                                                                                                • memory/4436-1222-0x0000024D6B9B0000-0x0000024D6B9D0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/4436-1217-0x0000024D6A900000-0x0000024D6AA00000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1024KB

                                                                                                                                                • memory/4436-1234-0x0000024D6B970000-0x0000024D6B990000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/4436-1245-0x0000024D6BD80000-0x0000024D6BDA0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/4504-1363-0x0000023712B00000-0x0000023712C00000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1024KB

                                                                                                                                                • memory/4504-1362-0x0000023712B00000-0x0000023712C00000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1024KB

                                                                                                                                                • memory/4504-1398-0x0000023713BC0000-0x0000023713BE0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/4504-1399-0x0000023713FD0000-0x0000023713FF0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/4504-1367-0x0000023713C00000-0x0000023713C20000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                • memory/4912-16-0x000001F36FC00000-0x000001F36FC24000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  144KB

                                                                                                                                                • memory/4912-14-0x000001F36EEB0000-0x000001F36EEC0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/4912-0-0x000001F36EEB0000-0x000001F36EEC0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/4912-7-0x000001F36E9B0000-0x000001F36E9D2000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  136KB

                                                                                                                                                • memory/4912-12-0x000001F36EEB0000-0x000001F36EEC0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/4912-1-0x000001F36EEB0000-0x000001F36EEC0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/4912-13-0x000001F36EEB0000-0x000001F36EEC0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/4912-18-0x000001F36EEB0000-0x000001F36EEC0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/4912-19-0x000001F36E9E0000-0x000001F36E9E2000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                • memory/4912-15-0x000001F36FC00000-0x000001F36FC2A000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  168KB

                                                                                                                                                • memory/5316-192-0x00000000048D0000-0x00000000048D1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/5452-1216-0x0000000004050000-0x0000000004051000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/5504-771-0x00000000041A0000-0x00000000041A1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/5564-1067-0x00000000040E0000-0x00000000040E1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/5812-470-0x0000000004C20000-0x0000000004C21000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB