3fa2764c014a709e27292a0507bd59dad69fd34d008e791be5694f427a62004b

Analysis

max time kernel
133s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nostroller Options V2.0/Nostroller Options V2.0.exe
Size 13.6MB
Sample260623-amfmtshx21
SHA256 3fa2764c014a709e27292a0507bd59dad69fd34d008e791be5694f427a62004b
MD5 e3f8f020efe0e0283d4e5a975ca8e77b
SHA1 a1f1869c5f02360cbfea7bc40de8610bfddd300a
SHA512 c03e05cc72a81210078e963d10851b252bf67c58061bfba25937a03b295a2f25aaa0eff4763e239360a15960fc4ca14d5f6e1ba8c6cae27db52c84cb9e17dd1f
SSDEEP 196608:nqKaY1IR1ZqfxZdXNSUVo5J3V0B4362StSgciD5brhAyW9DkdAEbJTz7CuGOo4:qw6R1Ufm/51q4K22Oi3iBdEbJTzOrOl
TLSH
T173E623BFA22149FCE09AC27885C3C592C6713D0C1A665BDF22CA165B0E37B943E7C55E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Loads dropped DLL 11 IoCs

pid	Process
4224	Nostroller Options V2.0.exe
4224	Nostroller Options V2.0.exe
4224	Nostroller Options V2.0.exe
4224	Nostroller Options V2.0.exe
4224	Nostroller Options V2.0.exe
4224	Nostroller Options V2.0.exe
4224	Nostroller Options V2.0.exe
4224	Nostroller Options V2.0.exe
4224	Nostroller Options V2.0.exe
4224	Nostroller Options V2.0.exe
4224	Nostroller Options V2.0.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\NotificationData	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{EA2B0A06-A585-49A2-8D30-1C8625DCE6C3}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{6448E1AB-4647-4B7A-BD4C-A9A152481ADE}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4224	Nostroller Options V2.0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
988	explorer.exe
988	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4224	Nostroller Options V2.0.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeShutdownPrivilege	988	explorer.exe
Token: SeCreatePagefilePrivilege	988	explorer.exe
Token: SeShutdownPrivilege	988	explorer.exe
Token: SeCreatePagefilePrivilege	988	explorer.exe
Token: SeShutdownPrivilege	988	explorer.exe
Token: SeCreatePagefilePrivilege	988	explorer.exe
Token: SeShutdownPrivilege	988	explorer.exe
Token: SeCreatePagefilePrivilege	988	explorer.exe
Token: SeShutdownPrivilege	988	explorer.exe
Token: SeCreatePagefilePrivilege	988	explorer.exe
Token: SeShutdownPrivilege	988	explorer.exe
Token: SeCreatePagefilePrivilege	988	explorer.exe
Token: SeShutdownPrivilege	988	explorer.exe
Token: SeCreatePagefilePrivilege	988	explorer.exe
Token: SeShutdownPrivilege	988	explorer.exe
Token: SeCreatePagefilePrivilege	988	explorer.exe
Token: SeShutdownPrivilege	988	explorer.exe
Token: SeCreatePagefilePrivilege	988	explorer.exe
Token: SeShutdownPrivilege	988	explorer.exe
Token: SeCreatePagefilePrivilege	988	explorer.exe
Token: SeShutdownPrivilege	988	explorer.exe
Token: SeCreatePagefilePrivilege	988	explorer.exe
Token: SeShutdownPrivilege	988	explorer.exe
Token: SeCreatePagefilePrivilege	988	explorer.exe
Token: SeShutdownPrivilege	988	explorer.exe
Token: SeCreatePagefilePrivilege	988	explorer.exe
Token: SeShutdownPrivilege	988	explorer.exe
Token: SeCreatePagefilePrivilege	988	explorer.exe
Token: SeShutdownPrivilege	988	explorer.exe
Token: SeCreatePagefilePrivilege	988	explorer.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
5772	sihost.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe
988	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2356	StartMenuExperienceHost.exe
1528	SearchHost.exe
988	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5772 wrote to memory of 988	5772	sihost.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Nostroller Options V2.0\Nostroller Options V2.0.exe
"C:\Users\Admin\AppData\Local\Temp\Nostroller Options V2.0\Nostroller Options V2.0.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:4224

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5772
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:988

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2356

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

evb90F1.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb90F1.tmp
Size 1KB
SHA256 5bb17a4dc80f0f54009d0be4d106c88be127d46ed7d86ef2745d33b4cc106bf6
MD5 5854a5a6a80209d9e37f3cb3b2c831af
SHA1 52ca095624fd9334c7f83402075b5100e20d7501
SHA512 3b0f2b41da40ed43a48b02a1a3a99626f4dc9c7b238b38d4acf1d42d4a062092166a1929681d049fa81829de2f678d638d144f2a70224f7c899d54db3c5205de
TLSH
T1A9315E12D6108AB2D18D073896D2992C26B8AC3493E956560FB0047EEC893304A39D09
MD5 SHA1 SHA512 TLSH

Submit Download

evb9160.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb9160.tmp
Size 1KB
SHA256 dcff47c82a87381125418cd812a3d668cfb6ce844430145c616566cf6b3c1132
MD5 602ad8ebcb52d933ecf776b6ca1b7998
SHA1 071eecb355daa32b23de2b81c8dff0ca576e5a31
SHA512 630837bd755a9c0bda5598fbbffbe9c0dadaa6b9aaaee85873f996674d7c48f2a32137d75225c6290732b6c21b7de2e058b6d5e5df362cf94a04cbf81643bf7f
TLSH
T1D9315E12D6118AB2C14D073896D2992D26B8AC3453E956560FB0047DEC853304E39D09
MD5 SHA1 SHA512 TLSH

Submit Download

evb93B3.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb93B3.tmp
Size 1KB
SHA256 17728a84ca88f2aebfc50773a88acb9dd8932af07d45927ce35258fd8cff4ba3
MD5 447aa65ff6c14438adddde66d6d9e43a
SHA1 843c0e6427b53befe251763e3d3a78272c43d63f
SHA512 75f96765d299e5ecfeb21b91ae6a1fe2b6681f8c8120869d3de315e41e4130a3b2d72bfaf89657048133b200c44fc321ab0ce1d309299173252cbf4958644b8c
TLSH
T1C831A713D610CAB7C18D077897D39A2C6AB8AC3453E957560FF0057DFC853304A39D09
MD5 SHA1 SHA512 TLSH

Submit Download

evb9B17.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb9B17.tmp
Size 1KB
SHA256 b749f0aaa37f1cb28248817d9af5a48d357594071f0a6b817b088f7c6d2a3d32
MD5 fb3710b6c5e2238bd54745a471864b81
SHA1 ff42c27095d38b8c3e6319c626d714edfa186cd2
SHA512 1d917bcf10c73666e8dab1603a8002a5b82dca4179f6b23c328bdc12e76fb340db7425d8248ae9775c174d8f906344ae4837b8804fce3407f9b87f19470870b2
TLSH
T1D4315E12D6108AB2C18D077896D39A2D26B8AC3453E956560FB0047DFC853304A39D09
MD5 SHA1 SHA512 TLSH

Submit Download

evb9B86.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb9B86.tmp
Size 1KB
SHA256 da8e1584e52135fbe21409fbe151cc07ef809fd355165789005518141cabaef1
MD5 8125213434a7fa4365ece498c0cbb0d0
SHA1 ecd681da190b037f40c45f41cc1a45a27ef88a9f
SHA512 8920512167338b24d0f0204548023408bbefc8ed3b14770b86f0950c7a8d824712e71574bd79500f3fd9aace152dd52e813f5fec483825adb4aece2320a8fc4d
TLSH
T146315E13D6108AB3C14D073896D2992C26B8AD3493E956560FB0047DEC853304A79D09
MD5 SHA1 SHA512 TLSH

Submit Download

evb9C24.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb9C24.tmp
Size 1KB
SHA256 ca5ad53f2e394808d6a2218d106d005a4ebb83b3886f000b595e706cfeee4bc0
MD5 c225ada10c88e6eec6df655e810947c5
SHA1 5d200d665d044997c3f8f9cc3313af23e85ea714
SHA512 35829970b277c8a24d2be71ec5fc57daa6183f0e62fa5a441136f6a740ceb5e33a444d568cfb778105f053f5128d2ac401b77dc5897e97d9a51e1cfb41b5963b
TLSH
T1CB315E12DA108AB2C14D073896D3992C66B8AC3453E916560FB004BDEC953704A39D09
MD5 SHA1 SHA512 TLSH

Submit Download

evb9C44.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb9C44.tmp
Size 1KB
SHA256 f1220859a6d442aea66cecba0834953fd780192d5b6d58d449de351e9f183a0c
MD5 820ea2ff6f2be365d8073b59b835117e
SHA1 ca9f0f26ac881c2541391672c0f4633f803eb161
SHA512 31a6ce5910dc4dd19b2701343a7e22b0bc8ebc1432491d980a0b90f8a5d6b1a0fb6ecfb976cd6165ab6f395443c47c11ebc55e19e64f4f7d93c6556528717e01
TLSH
T153315E12D610CAB2C14D073896D2996C26B8AD3463E916560FB0047DEC853304A3AD09
MD5 SHA1 SHA512 TLSH

Submit Download

evb9C74.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb9C74.tmp
Size 1KB
SHA256 d62fe9ed38b323515e6bc72f6562b51515a306fc81e4c6462b6d394545fd1fc5
MD5 8c62c21dc995cc89522198802289d4b7
SHA1 3abd4ee1688ecdbacf4289148e03ceca4b75f355
SHA512 e25188633b65a500205afcd6b7d91941aaff2153961b6e60fff762324a7cff6a1233f54a6299b96f46bddb18026e6cb10945866e9d8d8cb583a4e621b7f523f5
TLSH
T13E315E13D6108AB2C14D073896E2993C26B8AC3453E916560FB004BDEC953704A39D09
MD5 SHA1 SHA512 TLSH

Submit Download

evb9CA4.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb9CA4.tmp
Size 1KB
SHA256 bc2ab365a5379ec166f6c4aca0850336dff63e63202c75b25e764178e8281a84
MD5 bf4b28df387eb9b064dc5a5746a9761f
SHA1 61f41f1eeb652f9f8d72df7256955b064f1f65c7
SHA512 88dbf3040826001e38ef1185aabcbe73d973895e99deb87db1f8c1c12a8be78d4e4375b659276cabf0e68845415581214fa7c983557ecb1e2eb9bcbcd9164c2f
TLSH
T14D315E12DA10CAB6C15D07389AD2992C26B8AC3853EA16560FF0047DEC853304A79E09
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1528-228-0x0000027902A30000-0x0000027902A50000-memory.dmp

Download

memory/1528-205-0x00000279001E0000-0x00000279002E0000-memory.dmp

Download

memory/1528-235-0x0000027902D70000-0x0000027902D90000-memory.dmp

Download

memory/1528-229-0x0000027914000000-0x0000027914100000-memory.dmp

Download

memory/1528-249-0x00000279142A0000-0x00000279142C0000-memory.dmp

Download

memory/1528-203-0x00000279001E0000-0x00000279002E0000-memory.dmp

Download

memory/2356-367-0x000001A397300000-0x000001A3973FF000-memory.dmp

Download

memory/4224-67-0x0000000004F00000-0x0000000004F0E000-memory.dmp

Download

memory/4224-47-0x00000000024F0000-0x00000000025B8000-memory.dmp

Download

memory/4224-35-0x0000000180000000-0x00000001805BF000-memory.dmp

Download

memory/4224-39-0x0000000000720000-0x000000000072D000-memory.dmp

Download

memory/4224-42-0x0000000000720000-0x000000000072D000-memory.dmp

Download

memory/4224-55-0x00000000043D0000-0x00000000043F7000-memory.dmp

Download

memory/4224-58-0x00000000043D0000-0x00000000043F7000-memory.dmp

Download

memory/4224-64-0x0000000004F00000-0x0000000004F0A000-memory.dmp

Download

memory/4224-26-0x0000000003260000-0x00000000037C8000-memory.dmp

Download

memory/4224-77-0x0000000004F40000-0x0000000004FB2000-memory.dmp

Download

memory/4224-83-0x0000000140000000-0x00000001401C7000-memory.dmp

Download

memory/4224-89-0x00000000053F0000-0x000000000544A000-memory.dmp

Download

memory/4224-91-0x00007FFDC04E0000-0x00007FFDC0743000-memory.dmp

Download

memory/4224-87-0x00000000053F0000-0x000000000544A000-memory.dmp

Download

memory/4224-30-0x0000000003260000-0x00000000037C8000-memory.dmp

Download

memory/4224-85-0x0000000004FD0000-0x0000000004FDD000-memory.dmp

Download

memory/4224-92-0x00000000053F0000-0x000000000544A000-memory.dmp

Download

memory/4224-84-0x00007FFDC04E0000-0x00007FFDC0743000-memory.dmp

Download

memory/4224-24-0x0000000002B10000-0x0000000003254000-memory.dmp

Download

memory/4224-80-0x0000000004F40000-0x0000000004FB2000-memory.dmp

Download

memory/4224-75-0x0000000004F40000-0x0000000004FB2000-memory.dmp

Download

memory/4224-23-0x0000000180000000-0x00000001805BF000-memory.dmp

Download

memory/4224-73-0x0000000004F20000-0x0000000004F2E000-memory.dmp

Download

memory/4224-70-0x0000000004F00000-0x0000000004F0E000-memory.dmp

Download

memory/4224-68-0x0000000004F00000-0x0000000004F0E000-memory.dmp

Download

memory/4224-18-0x0000000002B10000-0x0000000003254000-memory.dmp

Download

memory/4224-63-0x0000000004F00000-0x0000000004F70000-memory.dmp

Download

memory/4224-62-0x0000000004F00000-0x0000000004F0C000-memory.dmp

Download

memory/4224-61-0x0000000004F00000-0x0000000004F0C000-memory.dmp

Download

memory/4224-60-0x0000000004F00000-0x0000000004F11000-memory.dmp

Download

memory/4224-59-0x00000000024F0000-0x00000000025B8000-memory.dmp

Download

memory/4224-57-0x00007FFDC04E0000-0x00007FFDC0743000-memory.dmp

Download

memory/4224-53-0x00000000043D0000-0x00000000043F7000-memory.dmp

Download

memory/4224-34-0x0000000003260000-0x00000000037C8000-memory.dmp

Download

memory/4224-50-0x00000000043D0000-0x00000000043F6000-memory.dmp

Download

memory/4224-44-0x00000000024F0000-0x00000000025B8000-memory.dmp

Download

memory/4224-40-0x00000000024F0000-0x00000000025B4000-memory.dmp

Download

memory/4224-38-0x0000000000720000-0x000000000072D000-memory.dmp

Download

memory/4224-93-0x0000000180000000-0x00000001805BF000-memory.dmp

Download

memory/4224-94-0x0000000002B10000-0x0000000003254000-memory.dmp

Download

memory/4224-95-0x0000000003260000-0x00000000037C8000-memory.dmp

Download

memory/4224-96-0x00007FFDC04E0000-0x00007FFDC0743000-memory.dmp

Download

memory/4224-97-0x00000000043D0000-0x00000000043F7000-memory.dmp

Download

memory/4224-98-0x00000000024F0000-0x00000000025B8000-memory.dmp

Download

memory/4224-99-0x0000000140000000-0x00000001401C7000-memory.dmp

Download

memory/4224-109-0x0000000004FD0000-0x0000000004FDD000-memory.dmp

Download

memory/4224-101-0x0000000002B10000-0x0000000003254000-memory.dmp

Download

memory/4224-100-0x0000000180000000-0x00000001805BF000-memory.dmp

Download

memory/4224-113-0x0000000002B10000-0x0000000003254000-memory.dmp

Download

memory/4224-114-0x0000000003260000-0x00000000037C8000-memory.dmp

Download

memory/4224-116-0x00000000024F0000-0x00000000025B8000-memory.dmp

Download

memory/4224-112-0x0000000180000000-0x00000001805BF000-memory.dmp

Download

memory/4224-126-0x0000000003260000-0x00000000037C8000-memory.dmp

Download

memory/4224-137-0x0000000002B10000-0x0000000003254000-memory.dmp

Download

memory/4224-138-0x0000000003260000-0x00000000037C8000-memory.dmp

Download

memory/4224-150-0x0000000003260000-0x00000000037C8000-memory.dmp

Download

memory/4224-162-0x0000000003260000-0x00000000037C8000-memory.dmp

Download

memory/4224-22-0x00007FFDC04E0000-0x00007FFDC0743000-memory.dmp

Download

memory/4224-193-0x0000000002B10000-0x0000000003254000-memory.dmp

Download

memory/4224-17-0x00007FFDC04E0000-0x00007FFDC0743000-memory.dmp

Download

memory/4224-12-0x0000000002B10000-0x0000000003254000-memory.dmp

Download

memory/4224-10-0x00007FFDC04E0000-0x00007FFDC0743000-memory.dmp

Download

memory/4224-5-0x0000000180000000-0x00000001805BF000-memory.dmp

Download

memory/4224-4-0x00007FFDC04E0000-0x00007FFDC0743000-memory.dmp

Download

memory/4224-2-0x00007FFDC063F000-0x00007FFDC0640000-memory.dmp

Download

memory/4224-0-0x0000000140000000-0x00000001401C7000-memory.dmp

Download

memory/4224-434-0x0000000140000000-0x00000001401C7000-memory.dmp

Download

memory/4224-447-0x0000000140000000-0x00000001401C7000-memory.dmp

Download