Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

85726ab0c6...18.exe

windows7-x64

10

85726ab0c6...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    79s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/08/2024, 08:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    85726ab0c6667aebe3db39ee5cceab18_JaffaCakes118.exe

  • Size

    496KB

  • MD5

    85726ab0c6667aebe3db39ee5cceab18

  • SHA1

    1a75826c9410c54c08e019ae7b2eb10528c095bd

  • SHA256

    4e9204eb4ea15ac832eedf2ec6b4dc259b26b00acd808bf0e877a010eaac81b8

  • SHA512

    8a9a9d42c48bf2ccd2eedcb91fd873c1ed2f8851658a8dc0bfa74b6bd6919edcb8fce561aff95b8fa1786787edce92e95fc5a4c1a9e936dc7fd5ac73d84469c9

  • SSDEEP

    12288:LDCPENnBV5jaHBoFvZstQW012B04Ngjw5qu8jxTQlDrLOM:LEEZBV5jCoFvZsSWG2BdN+w2+O

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 11 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 43 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\85726ab0c6667aebe3db39ee5cceab18_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\85726ab0c6667aebe3db39ee5cceab18_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1248
    • C:\Users\Admin\j29oAE.exe
      C:\Users\Admin\j29oAE.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1504
      • C:\Users\Admin\rnzin.exe
        "C:\Users\Admin\rnzin.exe"
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2968
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del j29oAE.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2448
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3232
    • C:\Users\Admin\2men.exe
      C:\Users\Admin\2men.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2940
      • C:\Users\Admin\2men.exe
        "C:\Users\Admin\2men.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1252
      • C:\Users\Admin\2men.exe
        "C:\Users\Admin\2men.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:556
      • C:\Users\Admin\2men.exe
        "C:\Users\Admin\2men.exe"
        3⤵
        • Executes dropped EXE
        • Maps connected drives based on registry
        • Suspicious behavior: EnumeratesProcesses
        PID:2672
      • C:\Users\Admin\2men.exe
        "C:\Users\Admin\2men.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4752
      • C:\Users\Admin\2men.exe
        "C:\Users\Admin\2men.exe"
        3⤵
        • Executes dropped EXE
        PID:4548
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 80
          4⤵
          • Program crash
          PID:4576
    • C:\Users\Admin\3men.exe
      C:\Users\Admin\3men.exe
      2⤵
      • Modifies security service
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1868
      • C:\Users\Admin\3men.exe
        C:\Users\Admin\3men.exe startC:\Users\Admin\AppData\Roaming\3B8E0\8358C.exe%C:\Users\Admin\AppData\Roaming\3B8E0
        3⤵
        • Executes dropped EXE
        PID:348
      • C:\Users\Admin\3men.exe
        C:\Users\Admin\3men.exe startC:\Program Files (x86)\E03E3\lvvm.exe%C:\Program Files (x86)\E03E3
        3⤵
        • Executes dropped EXE
        PID:4604
      • C:\Program Files (x86)\LP\8C03\59C3.tmp
        "C:\Program Files (x86)\LP\8C03\59C3.tmp"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2464
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del 85726ab0c6667aebe3db39ee5cceab18_JaffaCakes118.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4688
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2388
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4548 -ip 4548
    1⤵
      PID:3536
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4008
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2952
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:708
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2084
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4452
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4724
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SendNotifyMessage
      PID:4592
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3992
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:648
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4344
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3988
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4084
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1936
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2508
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:348
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:944
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4456
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4680
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1900
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4992
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:2500
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1928
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3936
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:2540
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1784
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3480
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      PID:856
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4028
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1512
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:976
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1848
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:4248
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3012
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:1900
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:4040
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:4928
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:4432
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:2944
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:4524
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:4592
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:2092
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:648
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:4260
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:3616
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:1784
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:1896
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:4816
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:4732
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:3312
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:4316
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:2736
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:4872
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:2204
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:2704
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:3984
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:4112
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:1100
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:3708
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:2552
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:3644
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:4020
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:4360
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:2704
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:3416
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:404
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:1632
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:4112
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:4396
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:3840
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:3676
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:4768
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:4720
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:4600
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:4248
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:4432
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:4040
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:868

                                                                                                Network

                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                Reconnaissance

                                                                                                Resource Development

                                                                                                Initial Access

                                                                                                Execution

                                                                                                Persistence

                                                                                                Boot or Logon Autostart Execution

                                                                                                2
                                                                                                T1547

                                                                                                Active Setup

                                                                                                1
                                                                                                T1547.014

                                                                                                Registry Run Keys / Startup Folder

                                                                                                1
                                                                                                T1547.001

                                                                                                Create or Modify System Process

                                                                                                1
                                                                                                T1543

                                                                                                Windows Service

                                                                                                1
                                                                                                T1543.003

                                                                                                Privilege Escalation

                                                                                                Boot or Logon Autostart Execution

                                                                                                2
                                                                                                T1547

                                                                                                Active Setup

                                                                                                1
                                                                                                T1547.014

                                                                                                Registry Run Keys / Startup Folder

                                                                                                1
                                                                                                T1547.001

                                                                                                Create or Modify System Process

                                                                                                1
                                                                                                T1543

                                                                                                Windows Service

                                                                                                1
                                                                                                T1543.003

                                                                                                Defense Evasion

                                                                                                Hide Artifacts

                                                                                                1
                                                                                                T1564

                                                                                                Hidden Files and Directories

                                                                                                1
                                                                                                T1564.001

                                                                                                Modify Registry

                                                                                                6
                                                                                                T1112

                                                                                                Credential Access

                                                                                                Credentials from Password Stores

                                                                                                1
                                                                                                T1555

                                                                                                Credentials from Web Browsers

                                                                                                1
                                                                                                T1555.003

                                                                                                Unsecured Credentials

                                                                                                3
                                                                                                T1552

                                                                                                Credentials In Files

                                                                                                3
                                                                                                T1552.001

                                                                                                Discovery

                                                                                                Peripheral Device Discovery

                                                                                                3
                                                                                                T1120

                                                                                                Process Discovery

                                                                                                1
                                                                                                T1057

                                                                                                Query Registry

                                                                                                6
                                                                                                T1012

                                                                                                System Information Discovery

                                                                                                5
                                                                                                T1082

                                                                                                System Location Discovery

                                                                                                1
                                                                                                T1614

                                                                                                System Language Discovery

                                                                                                1
                                                                                                T1614.001

                                                                                                Lateral Movement

                                                                                                Collection

                                                                                                Data from Local System

                                                                                                2
                                                                                                T1005

                                                                                                Command and Control

                                                                                                Exfiltration

                                                                                                Impact

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                • C:\Program Files (x86)\LP\8C03\59C3.tmp
                                                                                                  Filesize

                                                                                                  96KB

                                                                                                  MD5

                                                                                                  6b9ed8570a1857126c8bf99e0663926c

                                                                                                  SHA1

                                                                                                  94e08d8a0be09be35f37a9b17ec2130febfa2074

                                                                                                  SHA256

                                                                                                  888e4e571a6f78ee81d94ab56bd033d413f9160f1089073176b03c91878aae2d

                                                                                                  SHA512

                                                                                                  23211a1b71f1d05ad7f003231da826220ac4940e48071135cc3fba14708123fa0292e2e71c294a8086d8dc5f90dd32c4da3b41e6857c56f38cb325d78cb14880

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\2men.exe
                                                                                                  Filesize

                                                                                                  132KB

                                                                                                  MD5

                                                                                                  945a713b037b50442ec5d18d3dc0d55e

                                                                                                  SHA1

                                                                                                  2c8881b327a79fafcce27479b78f05487d93c802

                                                                                                  SHA256

                                                                                                  2da470571a64bcdeb56f62c916ee2bffa87ccc6c028b7c8cb0132d09bceedd2f

                                                                                                  SHA512

                                                                                                  0eab4bb5d04725cc20e463ae6959f71064674602f8ee7b3c9b2db75e928b9a0b1bdc94233dc261f6277d02e54a443b42a59b12aaebb8bbf243f0940344fbf385

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\3men.exe
                                                                                                  Filesize

                                                                                                  271KB

                                                                                                  MD5

                                                                                                  0d668203e24463de2bf228f00443b7bc

                                                                                                  SHA1

                                                                                                  eacff981d71f6648f6315e508bfd75e11683dba8

                                                                                                  SHA256

                                                                                                  509d530e99839d7dbc8fccac163420d9dc455fb478fa57fdec1b7a2ef629d7bc

                                                                                                  SHA512

                                                                                                  3251bb1341bd466e71468d72723bd5cf545dbd232327f343b44c51daae8755ed3caa02f74adbb0304912769346fa90dfa4c7036c211836e5650bdb06993ba803

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                  Filesize

                                                                                                  471B

                                                                                                  MD5

                                                                                                  21e0d572257ada4ab14416d6fe564195

                                                                                                  SHA1

                                                                                                  031bba08701767a5c7ecb2db402e87f6a8c24b95

                                                                                                  SHA256

                                                                                                  fd6145a13947d549a3834d42b0be89884a6c7a75908b22be49f7d6d8b0fec9d2

                                                                                                  SHA512

                                                                                                  ce2a59fc254b644b696db4f9e8dd5a56149a9a5fb39e124d4f7eeae09527ce498e432e4547264ee97fdd92f7e7c3e3349d9817f226d9a67a5932f6f905293f90

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                  Filesize

                                                                                                  420B

                                                                                                  MD5

                                                                                                  4fac06cce3996ad43ae6cc6b8a4de34c

                                                                                                  SHA1

                                                                                                  b08ce58d1cee5a353dff9177618e7805504837cd

                                                                                                  SHA256

                                                                                                  409e894a0078850c427db26db4116c3c20459c638202dc7f545dc327254d2fa9

                                                                                                  SHA512

                                                                                                  79f1f15ac674c4d44e2d2f127e7249da59ea6609fbb88f5a7070cbc04dad44b2fd6dd8a2c1b2d551064a169bd62e37a1c1a5e02bcf089c423adbb8eb502fefbb

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  58ee7f40cd2c4a69796382c6358967e0

                                                                                                  SHA1

                                                                                                  421ebb320b3099170154af852b7d8f6674f8a31a

                                                                                                  SHA256

                                                                                                  2624b890c026dfd48feaad4b03a643cd149b1b82df59d04d94b5adf1ef516500

                                                                                                  SHA512

                                                                                                  4bb227b944aa60f850bf9c9f7b339bc8d472727d244ee336fbd07b257d0927903fe02d81b6fdb4288cb6a2ebaf4688d1e244496186d219cd913ff5a45edfdeae

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133677527495905614.txt
                                                                                                  Filesize

                                                                                                  76KB

                                                                                                  MD5

                                                                                                  2b3d33e86e2cb297f9f8324d926e8e47

                                                                                                  SHA1

                                                                                                  9428274ad88cff5241c45ad675a1c7dc1c81f635

                                                                                                  SHA256

                                                                                                  c3e5119b75203030defd523fde0ee9dded50ee76a6966382b20828905e16185d

                                                                                                  SHA512

                                                                                                  e22e3d3467b01cffb76df840e01c4e4f1d2dc0edf7ad4d2ef9383953f18da7dc032c200b7cd0c1eccac65f52a472adda040988d7fa9c65410bf0cedcbc756b9e

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZLWU0D9R\microsoft.windows[1].xml
                                                                                                  Filesize

                                                                                                  97B

                                                                                                  MD5

                                                                                                  165c4eb495a1e55b6aa27652f79faaa1

                                                                                                  SHA1

                                                                                                  2a72fe3964fdace12d0527f52b806e545d9797b2

                                                                                                  SHA256

                                                                                                  d694847a55f98886fbb45c6cd2b0fed95d9cd7448660cd023c909b3659d1f51c

                                                                                                  SHA512

                                                                                                  e749ffaf79a8b65f26500c72b3bdacd79c564b89ea16198695892840873ede2b63fda3c6d32480cc5296d7662f91332f83674a5170475d606912af20e5f14367

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\3B8E0\03E3.B8E
                                                                                                  Filesize

                                                                                                  600B

                                                                                                  MD5

                                                                                                  b95147366d528f1e4c2b0f480d515670

                                                                                                  SHA1

                                                                                                  3264a5a072b1d4ad79bd2cedc07e40a6914ce667

                                                                                                  SHA256

                                                                                                  e93dbd8466d5c0dc3ea191be7927b4b5fed479825d02d9277f6057cc4749f3a2

                                                                                                  SHA512

                                                                                                  a88c66958f8d5c7bead5c00c5044d788743a26e005ac2ddcb2d391a39cb70693266f94be0cc32f69760dcf00c80f014ac1c1d63a682098f57f116dd602b73615

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\AppData\Roaming\3B8E0\03E3.B8E
                                                                                                  Filesize

                                                                                                  996B

                                                                                                  MD5

                                                                                                  661615947fd24ed413277995792c454d

                                                                                                  SHA1

                                                                                                  2123041bd20461c14e1e25810a1f68dc33ccce57

                                                                                                  SHA256

                                                                                                  402c63edec16456fac7ea94f28340375ddb99b2be63725a46bf3f16e9d4010fa

                                                                                                  SHA512

                                                                                                  4492481381c2e5124438c1ee2d71350fc6671bbd5cd3a2b3f19cc2ce7498830b427fda35fcbb649b8d42b1590ea8dadb9f04f65815e14b5f88ec4971381fbb1d

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\j29oAE.exe
                                                                                                  Filesize

                                                                                                  176KB

                                                                                                  MD5

                                                                                                  c4a634088e095eab98183984bb7252d8

                                                                                                  SHA1

                                                                                                  c205f2c1f8040c9205c6c06accd75c0396c59781

                                                                                                  SHA256

                                                                                                  db345985313397a39cc2817134315c8db71ab4c48680e62c0358db406b0eff6a

                                                                                                  SHA512

                                                                                                  b6a30f6d5cc30bee9b9d483629f16c80c5338360cec629f9ee2a3307b73b9743fd71396e408ac72008b84f4b8fded26002c910421853253b52b8b4d530df7a8e

                                                                                                  Download Submit

                                                                                                • C:\Users\Admin\rnzin.exe
                                                                                                  Filesize

                                                                                                  176KB

                                                                                                  MD5

                                                                                                  3e376e0c27850cf2436b65c35e1e0889

                                                                                                  SHA1

                                                                                                  01f704b79e2b67d889b855e396a468c2aeb0f6cd

                                                                                                  SHA256

                                                                                                  d92e1ecda2cf1b10066a1f0bd4828cdb03959a81de5e5be1c3a64315647c103b

                                                                                                  SHA512

                                                                                                  4bcf276227514cf0a26d527d97018257fa0ecffab5aafae206fdfdc73f94a3b07c9e8571bd25d98c8221588115d2e5f20c8ddedd25c2a2e9692e754df5daf0df

                                                                                                  Download Submit

                                                                                                • memory/348-100-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                  Filesize

                                                                                                  424KB

                                                                                                  Download

                                                                                                • memory/556-57-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                  Filesize

                                                                                                  56KB

                                                                                                  Download

                                                                                                • memory/556-59-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                  Filesize

                                                                                                  56KB

                                                                                                  Download

                                                                                                • memory/556-56-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                  Filesize

                                                                                                  56KB

                                                                                                  Download

                                                                                                • memory/556-53-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                  Filesize

                                                                                                  56KB

                                                                                                  Download

                                                                                                • memory/648-560-0x00000000044A0000-0x00000000044A1000-memory.dmp

                                                                                                  Filesize

                                                                                                  4KB

                                                                                                  Download

                                                                                                • memory/1252-49-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                                  Filesize

                                                                                                  28KB

                                                                                                  Download

                                                                                                • memory/1252-77-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                                  Filesize

                                                                                                  28KB

                                                                                                  Download

                                                                                                • memory/1252-51-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                                  Filesize

                                                                                                  28KB

                                                                                                  Download

                                                                                                • memory/1252-47-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                                  Filesize

                                                                                                  28KB

                                                                                                  Download

                                                                                                • memory/1868-87-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                  Filesize

                                                                                                  424KB

                                                                                                  Download

                                                                                                • memory/1868-105-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                  Filesize

                                                                                                  424KB

                                                                                                  Download

                                                                                                • memory/1868-430-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                  Filesize

                                                                                                  424KB

                                                                                                  Download

                                                                                                • memory/1868-710-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                  Filesize

                                                                                                  424KB

                                                                                                  Download

                                                                                                • memory/2084-277-0x0000000004670000-0x0000000004671000-memory.dmp

                                                                                                  Filesize

                                                                                                  4KB

                                                                                                  Download

                                                                                                • memory/2464-706-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                  Filesize

                                                                                                  112KB

                                                                                                  Download

                                                                                                • memory/2508-714-0x000001BD5A780000-0x000001BD5A880000-memory.dmp

                                                                                                  Filesize

                                                                                                  1024KB

                                                                                                  Download

                                                                                                • memory/2508-743-0x000001BD5BEC0000-0x000001BD5BEE0000-memory.dmp

                                                                                                  Filesize

                                                                                                  128KB

                                                                                                  Download

                                                                                                • memory/2508-731-0x000001BD5B8A0000-0x000001BD5B8C0000-memory.dmp

                                                                                                  Filesize

                                                                                                  128KB

                                                                                                  Download

                                                                                                • memory/2508-719-0x000001BD5B8E0000-0x000001BD5B900000-memory.dmp

                                                                                                  Filesize

                                                                                                  128KB

                                                                                                  Download

                                                                                                • memory/2672-63-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                  Filesize

                                                                                                  152KB

                                                                                                  Download

                                                                                                • memory/2672-62-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                  Filesize

                                                                                                  152KB

                                                                                                  Download

                                                                                                • memory/2672-85-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                  Filesize

                                                                                                  152KB

                                                                                                  Download

                                                                                                • memory/2672-64-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                  Filesize

                                                                                                  152KB

                                                                                                  Download

                                                                                                • memory/2672-60-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                                  Filesize

                                                                                                  152KB

                                                                                                  Download

                                                                                                • memory/3988-577-0x000002057E1C0000-0x000002057E1E0000-memory.dmp

                                                                                                  Filesize

                                                                                                  128KB

                                                                                                  Download

                                                                                                • memory/3988-588-0x000002057E5D0000-0x000002057E5F0000-memory.dmp

                                                                                                  Filesize

                                                                                                  128KB

                                                                                                  Download

                                                                                                • memory/3988-562-0x000002057D100000-0x000002057D200000-memory.dmp

                                                                                                  Filesize

                                                                                                  1024KB

                                                                                                  Download

                                                                                                • memory/3988-567-0x000002057E200000-0x000002057E220000-memory.dmp

                                                                                                  Filesize

                                                                                                  128KB

                                                                                                  Download

                                                                                                • memory/4084-713-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

                                                                                                  Filesize

                                                                                                  4KB

                                                                                                  Download

                                                                                                • memory/4604-272-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                  Filesize

                                                                                                  424KB

                                                                                                  Download

                                                                                                • memory/4724-300-0x000002BFC8740000-0x000002BFC8760000-memory.dmp

                                                                                                  Filesize

                                                                                                  128KB

                                                                                                  Download

                                                                                                • memory/4724-278-0x000002BFC7620000-0x000002BFC7720000-memory.dmp

                                                                                                  Filesize

                                                                                                  1024KB

                                                                                                  Download

                                                                                                • memory/4724-283-0x000002BFC8780000-0x000002BFC87A0000-memory.dmp

                                                                                                  Filesize

                                                                                                  128KB

                                                                                                  Download

                                                                                                • memory/4724-314-0x000002BFC8B50000-0x000002BFC8B70000-memory.dmp

                                                                                                  Filesize

                                                                                                  128KB

                                                                                                  Download

                                                                                                • memory/4724-280-0x000002BFC7620000-0x000002BFC7720000-memory.dmp

                                                                                                  Filesize

                                                                                                  1024KB

                                                                                                  Download

                                                                                                • memory/4724-279-0x000002BFC7620000-0x000002BFC7720000-memory.dmp

                                                                                                  Filesize

                                                                                                  1024KB

                                                                                                  Download

                                                                                                • memory/4752-69-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                                  Filesize

                                                                                                  28KB

                                                                                                  Download

                                                                                                • memory/4752-65-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                                  Filesize

                                                                                                  28KB

                                                                                                  Download

                                                                                                • memory/4752-67-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                                  Filesize

                                                                                                  28KB

                                                                                                  Download

                                                                                                • memory/4752-86-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                                  Filesize

                                                                                                  28KB

                                                                                                  Download