2e64cd510d4fc91add46b40bdbc2916a5e7ca640b2a93329bc64e98c5da88277

Analysis

user interaction
yes
max time kernel
124s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Topaz Video 1.4.1.exe
Size 198.3MB
Sample260702-tqa2asew2k
SHA256 2e64cd510d4fc91add46b40bdbc2916a5e7ca640b2a93329bc64e98c5da88277
MD5 aadf9f6478b7aa6e56f9fc68c59f9d7c
SHA1 2ff4f52c89b36a2f188cb49866e6406cd954dc24
SHA512 8cebba9858d1b0821d51e99651df6b06ba3085504310469c42f50a6cc7237bf8af612da6a47b2f9e23f9a47ab97e285bc02801e603b5609a16453957075d3c48
SSDEEP 3145728:nGisjvDF4jrt00qabXtlTWgPU6AffgT9H+HqqlHSPvSy9fA8p1pdAhyxvad35:nGNDF4jB8abdlyEV+/yH3rpdTxvad35
TLSH
T177A833828C2CDA67E22DA4F7843AB704D4D2795B6EF1934A5F0C6C431939B789C24FE5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery installer persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
1484	Topaz Video 1.4.1.tmp

Loads dropped DLL 4 IoCs

pid	Process
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Topaz Video 1.4.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Topaz Video 1.4.1.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral4/memory/5528-0-0x0000000000400000-0x0000000000417000-memory.dmp	innosetup
behavioral4/memory/5528-96-0x0000000000400000-0x0000000000417000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{F5EA28EA-0EC8-43A7-9EDA-5B498B772CB1}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{E7B4367E-AEA5-4CAA-98DD-D4DFEADF19C2}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
5768	explorer.exe
5768	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5768	explorer.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5768	explorer.exe
Token: SeCreatePagefilePrivilege	5768	explorer.exe
Token: SeShutdownPrivilege	5768	explorer.exe
Token: SeCreatePagefilePrivilege	5768	explorer.exe
Token: SeShutdownPrivilege	5768	explorer.exe
Token: SeCreatePagefilePrivilege	5768	explorer.exe
Token: SeShutdownPrivilege	5768	explorer.exe
Token: SeCreatePagefilePrivilege	5768	explorer.exe
Token: SeShutdownPrivilege	5768	explorer.exe
Token: SeCreatePagefilePrivilege	5768	explorer.exe
Token: SeShutdownPrivilege	5768	explorer.exe
Token: SeCreatePagefilePrivilege	5768	explorer.exe
Token: SeShutdownPrivilege	5768	explorer.exe
Token: SeCreatePagefilePrivilege	5768	explorer.exe
Token: SeShutdownPrivilege	5768	explorer.exe
Token: SeCreatePagefilePrivilege	5768	explorer.exe
Token: SeShutdownPrivilege	5768	explorer.exe
Token: SeCreatePagefilePrivilege	5768	explorer.exe
Token: SeShutdownPrivilege	5768	explorer.exe
Token: SeCreatePagefilePrivilege	5768	explorer.exe
Token: SeShutdownPrivilege	5768	explorer.exe
Token: SeCreatePagefilePrivilege	5768	explorer.exe
Token: SeShutdownPrivilege	5768	explorer.exe
Token: SeCreatePagefilePrivilege	5768	explorer.exe
Token: SeShutdownPrivilege	5768	explorer.exe
Token: SeCreatePagefilePrivilege	5768	explorer.exe
Token: SeShutdownPrivilege	5768	explorer.exe
Token: SeCreatePagefilePrivilege	5768	explorer.exe
Token: SeShutdownPrivilege	5768	explorer.exe
Token: SeCreatePagefilePrivilege	5768	explorer.exe
Token: SeShutdownPrivilege	5768	explorer.exe
Token: SeCreatePagefilePrivilege	5768	explorer.exe
Token: SeShutdownPrivilege	5768	explorer.exe
Token: SeCreatePagefilePrivilege	5768	explorer.exe
Token: SeShutdownPrivilege	5768	explorer.exe
Token: SeCreatePagefilePrivilege	5768	explorer.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
5836	sihost.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe
5768	explorer.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
1484	Topaz Video 1.4.1.tmp
916	StartMenuExperienceHost.exe
3268	SearchHost.exe
5768	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5528 wrote to memory of 1484	5528	Topaz Video 1.4.1.exe	87
PID 5836 wrote to memory of 5768	5836	sihost.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Topaz Video 1.4.1.exe
"C:\Users\Admin\AppData\Local\Temp\Topaz Video 1.4.1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5528
- C:\Users\Admin\AppData\Local\Temp\is-Q5D9B.tmp\Topaz Video 1.4.1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-Q5D9B.tmp\Topaz Video 1.4.1.tmp" /SL5="$301F6,207529790,64512,C:\Users\Admin\AppData\Local\Temp\Topaz Video 1.4.1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1484

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5836
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5768

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3268

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

Topaz Video 1.4.1.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-Q5D9B.tmp\Topaz Video 1.4.1.tmp
Size 911KB
SHA256 a5e4a29e45ae865c37e5e90d0ca893db815b9495f6703aa1921b9d95274d4e00
MD5 79ea0131e62606f2170bfbe0890f1649
SHA1 dd7e52dfa52a67218628061996b2e54fa5a26929
SHA512 8875b40dc544a3e54570992a218fb4717c0f44194be3bc5c23d1cc48e646585e434fe03e79c59de7430430954d4ef40baef841eb26cb0accea853f3cfbe69115
SSDEEP 24576:wkHgKPNrPA37hzHIA6/oR36vln6sYEubnhRgZtnTbDExlDr:w6frPA37hzHIA6/3UvjhRgZ9TYB
TLSH
T13C157B22F280E437C2A31E749E5797D5693ABD043E28699B7BFD1F4C0E3954239263D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISTask.dll

Path C:\Users\Admin\AppData\Local\Temp\is-UT5AJ.tmp\ISTask.dll
Size 66KB
SHA256 e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d
MD5 86a1311d51c00b278cb7f27796ea442e
SHA1 ac08ac9d08f8f5380e2a9a65f4117862aa861a19
SHA512 129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec
SSDEEP 1536:KVqiEnH9RGX9xXLUWB1GOlb3MvH4xK+RRlm9A:isGX3Vwwbc6Rlm9A
TLSH
T138635C07B6D08676E072AFBC5C39A214A63B7D353D35D0ADABB90D8D4E282C29D4C357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VclStylesInno.dll

Path C:\Users\Admin\AppData\Local\Temp\is-UT5AJ.tmp\VclStylesInno.dll
Size 3.0MB
SHA256 0e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
MD5 b0ca93ceb050a2feff0b19e65072bbb5
SHA1 7ebbbbe2d2acd8fd516f824338d254a33b69f08d
SHA512 37242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2
SSDEEP 49152:fvdCka90J5FJ8n2uRrH12SSSAt4VOZkT7LZc8/:fg65FOnRZAt4VObK
TLSH
T12EE56C27B2447A3EC0AB1B3D983BA294AD3FB71177179C5A5BF40C8C8E35580393A597
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1484-64-0x0000000008430000-0x0000000008431000-memory.dmp

Download

memory/1484-38-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-28-0x0000000008370000-0x0000000008371000-memory.dmp

Download

memory/1484-42-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-45-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-82-0x0000000008490000-0x0000000008491000-memory.dmp

Download

memory/1484-84-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-83-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-81-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-80-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-58-0x0000000008410000-0x0000000008411000-memory.dmp

Download

memory/1484-77-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-87-0x000000000808E000-0x000000000808F000-memory.dmp

Download

memory/1484-75-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-74-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-72-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-71-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-69-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-68-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-66-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-65-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-63-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-62-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-60-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-59-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-57-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-56-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-54-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-53-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-51-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-50-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-79-0x0000000008480000-0x0000000008481000-memory.dmp

Download

memory/1484-73-0x0000000008460000-0x0000000008461000-memory.dmp

Download

memory/1484-70-0x0000000008450000-0x0000000008451000-memory.dmp

Download

memory/1484-52-0x00000000083F0000-0x00000000083F1000-memory.dmp

Download

memory/1484-61-0x0000000008420000-0x0000000008421000-memory.dmp

Download

memory/1484-78-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-23-0x0000000007EF0000-0x000000000820A000-memory.dmp

Download

memory/1484-17-0x0000000002520000-0x0000000002536000-memory.dmp

Download

memory/1484-48-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-47-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-49-0x00000000083E0000-0x00000000083E1000-memory.dmp

Download

memory/1484-44-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-76-0x0000000008470000-0x0000000008471000-memory.dmp

Download

memory/1484-67-0x0000000008440000-0x0000000008441000-memory.dmp

Download

memory/1484-46-0x00000000083D0000-0x00000000083D1000-memory.dmp

Download

memory/1484-55-0x0000000008400000-0x0000000008401000-memory.dmp

Download

memory/1484-36-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-35-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-33-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-32-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-43-0x00000000083C0000-0x00000000083C1000-memory.dmp

Download

memory/1484-41-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-40-0x00000000083B0000-0x00000000083B1000-memory.dmp

Download

memory/1484-39-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-37-0x00000000083A0000-0x00000000083A1000-memory.dmp

Download

memory/1484-34-0x0000000008390000-0x0000000008391000-memory.dmp

Download

memory/1484-31-0x0000000008380000-0x0000000008381000-memory.dmp

Download

memory/1484-30-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-29-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-27-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-26-0x0000000008210000-0x0000000008350000-memory.dmp

Download

memory/1484-25-0x0000000008360000-0x0000000008361000-memory.dmp

Download

memory/1484-88-0x0000000007EF0000-0x000000000820A000-memory.dmp

Download

memory/1484-89-0x0000000007EF0000-0x000000000820A000-memory.dmp

Download

memory/1484-90-0x0000000007EF0000-0x000000000820A000-memory.dmp

Download

memory/1484-91-0x0000000007EF0000-0x000000000820A000-memory.dmp

Download

memory/1484-93-0x0000000007EF0000-0x000000000820A000-memory.dmp

Download

memory/1484-92-0x0000000007EF0000-0x000000000820A000-memory.dmp

Download

memory/1484-100-0x00000000022B0000-0x00000000022B1000-memory.dmp

Download

memory/1484-101-0x0000000007EF0000-0x000000000820A000-memory.dmp

Download

memory/1484-6-0x00000000022B0000-0x00000000022B1000-memory.dmp

Download

memory/5528-0-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5528-96-0x0000000000400000-0x0000000000417000-memory.dmp

Download