Analysis

  • max time kernel
    31s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250610-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/07/2025, 06:53

General

  • Target

    Eksportindustrien.ps1

  • Size

    54KB

  • MD5

    e9e3dfcb65a6f62522714916d1ccd491

  • SHA1

    09319cafa05d6f9fb66e11c6ac3c41046b28e9e0

  • SHA256

    7beab23f05657b7b773b6e6facccfcc81bdde6bbc7a23c435b4a5b8e94674e2e

  • SHA512

    df3999ee5e66db05047989d1c50546bf256bab29bf850985bf89de3aef9b7a3445c7ac1db199a8b22e6b347f0db6e2fc813770b67c14dcc8d12ef4e72332f055

  • SSDEEP

    1536:TK2MNrH82wxdRFew8ACyLqzkK26AgV4VDBs:OfNBwBI9ACyLqYeZKs

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Eksportindustrien.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1704
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2424
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4476
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4108
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2372
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3980
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:4204
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1936
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1092
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:4908
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2440
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:2600
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3512
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4456
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2432
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:4284
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:3052
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:1852
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:4528
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:4028
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:372
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:2624
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:1800
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:4156
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3740
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:1744
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:4204
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:3824
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:5028
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:4200
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:892
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:3468
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:3696
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:4536
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:1984
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:4676
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:432
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:1764
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:1576
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4556
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:2664
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:1988
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:2080
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:2276
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:3820
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:3588
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:1492
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:4672
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:1704
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:788
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:3880
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:3228
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:4480
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:4100
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:4576
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:1092
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:4412
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:5044
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:4844
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:544
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:1984
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:1888
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:3000
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:5080
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:112
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:372
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:4112
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:1908
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                            1⤵
                                                                                                              PID:4300
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:1228
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:4772
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                  1⤵
                                                                                                                    PID:3176
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:560
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                      1⤵
                                                                                                                        PID:3040
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                        1⤵
                                                                                                                          PID:4604
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe
                                                                                                                          1⤵
                                                                                                                            PID:1988
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                            1⤵
                                                                                                                              PID:880
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                              1⤵
                                                                                                                                PID:3980
                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                explorer.exe
                                                                                                                                1⤵
                                                                                                                                  PID:3704
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:4224
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:4672
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      explorer.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:1744
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:3156
                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                          1⤵
                                                                                                                                            PID:3596
                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                            explorer.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:396
                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                              1⤵
                                                                                                                                                PID:4452
                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                1⤵
                                                                                                                                                  PID:2344

                                                                                                                                                Network

                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                      Replay Monitor

                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                      Downloads

                                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                                                                        Filesize

                                                                                                                                                        471B

                                                                                                                                                        MD5

                                                                                                                                                        3ef39b791de2c639ea3f827068b6a875

                                                                                                                                                        SHA1

                                                                                                                                                        828ff318380258836ffa989c665d8e3d71a76fc9

                                                                                                                                                        SHA256

                                                                                                                                                        9635cf402e7e153b4398740dd15077ca7b1df339d62e92b8317b4078679fb5d3

                                                                                                                                                        SHA512

                                                                                                                                                        a5864fee2b4c73533dbd155b6a899109bb3c122b90d8d06d243ba5775ea41593bf14363eb247d9779d5fec752904ce0a416af9fdef4f8bdaf9180750c03275e4

                                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                                                                        Filesize

                                                                                                                                                        412B

                                                                                                                                                        MD5

                                                                                                                                                        c60f00ffbbe26fc31fa04b7dc913849c

                                                                                                                                                        SHA1

                                                                                                                                                        080712191bdd6aa378f6e9681aefb49a8097f838

                                                                                                                                                        SHA256

                                                                                                                                                        befe4a4447f10b1b7422b7662438008797050e82ec57726deea0f450ee64b74d

                                                                                                                                                        SHA512

                                                                                                                                                        874adcfe0aea5d618c75978cc70585c6a97fb9a38dd75c54e490ecb5215464f979f6078fefba9650b38468e93f78f6c448fb1e5baf81bca8c9c1812983f943a8

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                                                                        Filesize

                                                                                                                                                        2KB

                                                                                                                                                        MD5

                                                                                                                                                        a65e7cfcf8af984cdb4415fc9d4e8814

                                                                                                                                                        SHA1

                                                                                                                                                        9fc8b913ac80948aebf66b043a308ba136059082

                                                                                                                                                        SHA256

                                                                                                                                                        aba3ef04c89f247029ae68ad22e2a5bdfcd7a2655d8dd8cf7f8f7d4c518061b0

                                                                                                                                                        SHA512

                                                                                                                                                        ca11e53544bc0fa41839169c584cb53cf9f76bdbec093f68020199c6b10a1d0b3b7f7e0fd5cacc72ee8177478f97a1cc24f2fd30c4e7a186d09281e376d3a492

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15

                                                                                                                                                        Filesize

                                                                                                                                                        36KB

                                                                                                                                                        MD5

                                                                                                                                                        0e2a09c8b94747fa78ec836b5711c0c0

                                                                                                                                                        SHA1

                                                                                                                                                        92495421ad887f27f53784c470884802797025ad

                                                                                                                                                        SHA256

                                                                                                                                                        0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                                                                                                        SHA512

                                                                                                                                                        61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel

                                                                                                                                                        Filesize

                                                                                                                                                        36KB

                                                                                                                                                        MD5

                                                                                                                                                        fb5f8866e1f4c9c1c7f4d377934ff4b2

                                                                                                                                                        SHA1

                                                                                                                                                        d0a329e387fb7bcba205364938417a67dbb4118a

                                                                                                                                                        SHA256

                                                                                                                                                        1649ec9493be27f76ae7304927d383f8a53dd3e41ea1678bacaff33120ea4170

                                                                                                                                                        SHA512

                                                                                                                                                        0fbe2843dfeab7373cde0643b20c073fdc2fcbefc5ae581fd1656c253dfa94e8bba4d348e95cc40d1e872456ecca894b462860aeac8b92cedb11a7cad634798c

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133958264406060034.txt

                                                                                                                                                        Filesize

                                                                                                                                                        84KB

                                                                                                                                                        MD5

                                                                                                                                                        0ffcd8a77ddfd39140eba49cba78c5f3

                                                                                                                                                        SHA1

                                                                                                                                                        4c79d28f18e67cb251ffc0a51073ac9bb0dfcc0a

                                                                                                                                                        SHA256

                                                                                                                                                        e8eba8cd7daf396d041ec0c04b6fbd01fef82a58c9a2a4e4cf41f4c9215cffff

                                                                                                                                                        SHA512

                                                                                                                                                        6aaf1bef17de90a2735a2cbb4a9635e65c764c3bfe7448ac1aaa4a7181329007d30ac8b8381741ce0087eeec18e231901913e9962ce63b25a31fde4cb0926a58

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ARS2BD4S\microsoft.windows[1].xml

                                                                                                                                                        Filesize

                                                                                                                                                        95B

                                                                                                                                                        MD5

                                                                                                                                                        285acef4a6d93ada14a04a2df3b9fe85

                                                                                                                                                        SHA1

                                                                                                                                                        c003700fc1007cffa852cc8efe8540767980839d

                                                                                                                                                        SHA256

                                                                                                                                                        4f39b867eb488efcbc0c7f0b8b0781388a01549eeea1b1db305edfbac6494837

                                                                                                                                                        SHA512

                                                                                                                                                        55e1c94fb7168c4adb2aad9aeff791474d5d3e7512738ef331c17c9d2b87e8dc173c6412a71d1b14a5420e45b6499dc0d5b98d40a4b906e1826179f92a6197a8

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_waq0dixp.py0.ps1

                                                                                                                                                        Filesize

                                                                                                                                                        60B

                                                                                                                                                        MD5

                                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                        SHA1

                                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                        SHA256

                                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                        SHA512

                                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                      • memory/372-800-0x000001D334AE0000-0x000001D334B00000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/372-818-0x000001D335100000-0x000001D335120000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/372-786-0x000001D334B20000-0x000001D334B40000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/372-781-0x000001D333C00000-0x000001D333D00000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1024KB

                                                                                                                                                      • memory/432-1651-0x0000000004910000-0x0000000004911000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                      • memory/892-1363-0x0000000004320000-0x0000000004321000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                      • memory/1092-204-0x0000021E18AB0000-0x0000021E18AD0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/1092-199-0x0000021E17B50000-0x0000021E17C50000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1024KB

                                                                                                                                                      • memory/1092-200-0x0000021E17B50000-0x0000021E17C50000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1024KB

                                                                                                                                                      • memory/1092-236-0x0000021E19080000-0x0000021E190A0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/1092-214-0x0000021E18A70000-0x0000021E18A90000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/1092-201-0x0000021E17B50000-0x0000021E17C50000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1024KB

                                                                                                                                                      • memory/1576-1671-0x0000021F668F0000-0x0000021F66910000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/1576-1655-0x0000021F65800000-0x0000021F65900000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1024KB

                                                                                                                                                      • memory/1576-1684-0x0000021F66D00000-0x0000021F66D20000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/1576-1659-0x0000021F66930000-0x0000021F66950000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/1704-1-0x00000283EBCD0000-0x00000283EBCE0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        64KB

                                                                                                                                                      • memory/1704-18-0x00000283EE280000-0x00000283EE282000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        8KB

                                                                                                                                                      • memory/1704-17-0x00000283EBCD0000-0x00000283EBCE0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        64KB

                                                                                                                                                      • memory/1704-15-0x00000283EE270000-0x00000283EE294000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        144KB

                                                                                                                                                      • memory/1704-14-0x00000283EE270000-0x00000283EE29A000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        168KB

                                                                                                                                                      • memory/1704-13-0x00000283EBCD0000-0x00000283EBCE0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        64KB

                                                                                                                                                      • memory/1704-12-0x00000283EBCD0000-0x00000283EBCE0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        64KB

                                                                                                                                                      • memory/1704-2-0x00000283EDD50000-0x00000283EDD72000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        136KB

                                                                                                                                                      • memory/1704-0-0x00000283EBCD0000-0x00000283EBCE0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        64KB

                                                                                                                                                      • memory/1852-640-0x000001B3510C0000-0x000001B3510E0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/1852-635-0x000001B350160000-0x000001B350260000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1024KB

                                                                                                                                                      • memory/1852-653-0x000001B351080000-0x000001B3510A0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/1852-672-0x000001B3516A0000-0x000001B3516C0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/2432-512-0x000001F2B6450000-0x000001F2B6470000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/2432-502-0x000001F2B6040000-0x000001F2B6060000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/2432-491-0x000001F2B6080000-0x000001F2B60A0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/2432-486-0x000001F2B4F20000-0x000001F2B5020000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1024KB

                                                                                                                                                      • memory/2600-361-0x00000262D6700000-0x00000262D6720000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/2600-372-0x00000262D6B00000-0x00000262D6B20000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/2600-352-0x00000262D6740000-0x00000262D6760000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/2600-347-0x00000262D5600000-0x00000262D5700000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1024KB

                                                                                                                                                      • memory/2624-931-0x0000000003F40000-0x0000000003F41000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                      • memory/3512-484-0x0000000004670000-0x0000000004671000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                      • memory/3696-1402-0x0000026D45480000-0x0000026D454A0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/3696-1383-0x0000026D44E70000-0x0000026D44E90000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/3696-1370-0x0000026D44EB0000-0x0000026D44ED0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/3696-1366-0x0000026D43F50000-0x0000026D44050000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1024KB

                                                                                                                                                      • memory/3696-1365-0x0000026D43F50000-0x0000026D44050000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1024KB

                                                                                                                                                      • memory/3740-1076-0x0000000003E20000-0x0000000003E21000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                      • memory/3824-1219-0x0000000004C00000-0x0000000004C01000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                      • memory/3980-29-0x000002160D500000-0x000002160D600000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1024KB

                                                                                                                                                      • memory/3980-58-0x000002160E8D0000-0x000002160E8F0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/3980-28-0x000002160D500000-0x000002160D600000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1024KB

                                                                                                                                                      • memory/3980-33-0x000002160E500000-0x000002160E520000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/3980-46-0x000002160E4C0000-0x000002160E4E0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/4108-27-0x0000000004830000-0x0000000004831000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                      • memory/4156-950-0x000001550E470000-0x000001550E490000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/4156-938-0x000001550E4B0000-0x000001550E4D0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/4156-933-0x000001550D550000-0x000001550D650000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1024KB

                                                                                                                                                      • memory/4156-970-0x000001550EA80000-0x000001550EAA0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/4156-935-0x000001550D550000-0x000001550D650000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1024KB

                                                                                                                                                      • memory/4200-1236-0x0000026233D80000-0x0000026233DA0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/4200-1257-0x0000026234190000-0x00000262341B0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/4200-1225-0x0000026233DC0000-0x0000026233DE0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/4200-1221-0x0000026232D00000-0x0000026232E00000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1024KB

                                                                                                                                                      • memory/4204-1091-0x000002D230280000-0x000002D2302A0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/4204-197-0x00000000035D0000-0x00000000035D1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                      • memory/4204-1115-0x000002D2308A0000-0x000002D2308C0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/4204-1083-0x000002D2302C0000-0x000002D2302E0000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/4284-634-0x00000000043A0000-0x00000000043A1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                      • memory/4528-780-0x0000000003330000-0x0000000003331000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                      • memory/4536-1510-0x0000000004790000-0x0000000004791000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                      • memory/4676-1511-0x0000024287620000-0x0000024287720000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1024KB

                                                                                                                                                      • memory/4676-1516-0x0000024288660000-0x0000024288680000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/4676-1528-0x0000024288620000-0x0000024288640000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/4676-1548-0x0000024288A30000-0x0000024288A50000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        128KB

                                                                                                                                                      • memory/4908-345-0x0000000004C30000-0x0000000004C31000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4KB