Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

d068b3fe41...18.exe

windows7-x64

10

d068b3fe41...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    90s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/09/2024, 20:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d068b3fe41ac9d98cd3a29d3bb4883a5_JaffaCakes118.exe

  • Size

    272KB

  • MD5

    d068b3fe41ac9d98cd3a29d3bb4883a5

  • SHA1

    c045143d113e295b6765f364fd5c468e5086369e

  • SHA256

    04615bb86170e97f549f956cae47e06954c618207c4bc0189a18b0eb95127838

  • SHA512

    4a2f1a4366b9250b66f704bdfc0280b2a10a1eb1b06ae579338df49c7ac07a527a2d6931da791586876a34dafd63a771082701f3a06052fac826bd5781911e05

  • SSDEEP

    6144:K3yLcxK+CXab720WKQVCAU4HbC2iiajmS7crmaY:KCqcG20WKopHNhpxL

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 13 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\d068b3fe41ac9d98cd3a29d3bb4883a5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d068b3fe41ac9d98cd3a29d3bb4883a5_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3512
    • C:\Users\Admin\AppData\Local\Temp\d068b3fe41ac9d98cd3a29d3bb4883a5_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d068b3fe41ac9d98cd3a29d3bb4883a5_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\BF253\C588C.exe%C:\Users\Admin\AppData\Roaming\BF253
      2⤵
      • System Location Discovery: System Language Discovery
      PID:660
    • C:\Users\Admin\AppData\Local\Temp\d068b3fe41ac9d98cd3a29d3bb4883a5_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d068b3fe41ac9d98cd3a29d3bb4883a5_JaffaCakes118.exe startC:\Program Files (x86)\53CCA\lvvm.exe%C:\Program Files (x86)\53CCA
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1064
    • C:\Program Files (x86)\LP\8C3B\FA1F.tmp
      "C:\Program Files (x86)\LP\8C3B\FA1F.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4704
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3028
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4588
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2456
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4088
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2708
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4576
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    PID:4596
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3088
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of SendNotifyMessage
    PID:5028
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3908
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5088
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:3248
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4904
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1644
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1820
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1096
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:2564
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1716
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:656
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3540
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1096
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3132
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:532
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4364
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2168
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3192
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3148
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4740
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:3684
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3792
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1708
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:3940
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3580
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4564
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4344
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:660
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:2264
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:3740
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:5072
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:4244
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4256
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:3708
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:3636
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3160
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:532
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:3740
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:5032
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:3936
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:4492
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:3444
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:4540
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:3192
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:344
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:4344
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:3576
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:5020
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:4032
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:4040
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:1096
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:2512
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:1572
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:312
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:3900
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:3576
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:2988
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:2912
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:4076
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:4124
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:4868
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:4592
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:3480

                                                                          Network

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Reconnaissance

                                                                          Resource Development

                                                                          Initial Access

                                                                          Execution

                                                                          Persistence

                                                                          Boot or Logon Autostart Execution

                                                                          2
                                                                          T1547

                                                                          Active Setup

                                                                          1
                                                                          T1547.014

                                                                          Registry Run Keys / Startup Folder

                                                                          1
                                                                          T1547.001

                                                                          Create or Modify System Process

                                                                          1
                                                                          T1543

                                                                          Windows Service

                                                                          1
                                                                          T1543.003

                                                                          Privilege Escalation

                                                                          Boot or Logon Autostart Execution

                                                                          2
                                                                          T1547

                                                                          Active Setup

                                                                          1
                                                                          T1547.014

                                                                          Registry Run Keys / Startup Folder

                                                                          1
                                                                          T1547.001

                                                                          Create or Modify System Process

                                                                          1
                                                                          T1543

                                                                          Windows Service

                                                                          1
                                                                          T1543.003

                                                                          Defense Evasion

                                                                          Modify Registry

                                                                          5
                                                                          T1112

                                                                          Credential Access

                                                                          Credentials from Password Stores

                                                                          1
                                                                          T1555

                                                                          Credentials from Web Browsers

                                                                          1
                                                                          T1555.003

                                                                          Unsecured Credentials

                                                                          3
                                                                          T1552

                                                                          Credentials In Files

                                                                          3
                                                                          T1552.001

                                                                          Discovery

                                                                          Peripheral Device Discovery

                                                                          2
                                                                          T1120

                                                                          Query Registry

                                                                          4
                                                                          T1012

                                                                          System Information Discovery

                                                                          2
                                                                          T1082

                                                                          System Location Discovery

                                                                          1
                                                                          T1614

                                                                          System Language Discovery

                                                                          1
                                                                          T1614.001

                                                                          Lateral Movement

                                                                          Collection

                                                                          Data from Local System

                                                                          2
                                                                          T1005

                                                                          Command and Control

                                                                          Exfiltration

                                                                          Impact

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          • C:\Program Files (x86)\LP\8C3B\FA1F.tmp
                                                                            Filesize

                                                                            97KB

                                                                            MD5

                                                                            1982720acf8fa5cce7ed7378d6df64bd

                                                                            SHA1

                                                                            ff1302f00bcacedcc895f17eae364ac2bb1c338b

                                                                            SHA256

                                                                            e78dc40dbcc630291632cec308b1c76c95bbe4a103561003fd63706eddb3ce3b

                                                                            SHA512

                                                                            efaf84039f45fd9445270048cd734bfcb6e3785af7223ee8a89a3a0d74cc5977b8368a674132d5e9c1945a6c22c8a7bef21465ef17077c81082704e43a04e481

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                            Filesize

                                                                            471B

                                                                            MD5

                                                                            db11889e5a4b172a7b3c09cf02207c59

                                                                            SHA1

                                                                            3ed64c9296b903975c3260d19b3e62fb110a1ef1

                                                                            SHA256

                                                                            c639ee3d306c3daba8adaa04a28e337105f9d6407e5bf756a915db45d089bde6

                                                                            SHA512

                                                                            e57120fc7a260e3c2d401b98bd24ba84a170f494e4c5540c8477e65cac6fbb4ab62e5f24a81f571f06d6abdb3282f1b5406910387ac364b3b6dbb9d0a711e250

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                            Filesize

                                                                            420B

                                                                            MD5

                                                                            2c03dbd5e18d31d2204526220ac9ac7a

                                                                            SHA1

                                                                            b7f05c3f7b2bcb6c340e9814040cca1565e5bdb0

                                                                            SHA256

                                                                            d8e953029fa8ed2535157ca0c59c9ac7f9d5c1d93b36c7f89c7ff8ba80bf43dc

                                                                            SHA512

                                                                            afe218954871f474961942a6db25e0abc519558e6f4964d49048f8c0931d6910926a8d1bfa4e7785ece4c5f9c9c78ee6e52c0261c27621e143223a4f2314f2ab

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            196cda1c0c6e2a9ebfa90bd057bc6946

                                                                            SHA1

                                                                            740136edfbb97b043637381be34e8411b5105ba0

                                                                            SHA256

                                                                            e1ea90c01a526d37b37e8305ab53f953ea0ab2516409219d1dc973982d513665

                                                                            SHA512

                                                                            d32a00a11a8c17526aacecbfa55d8d1e8e2971269fda4203fdb6bce023016d82e3f4e3ac30f5a90c60ae4f65bdfcada649ed1fe2c4e2943032ed6fe96cdc7cdc

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\RMU4N5WP\microsoft.windows[1].xml
                                                                            Filesize

                                                                            97B

                                                                            MD5

                                                                            1e30d8c8ef07e3c98200641a90d1ae95

                                                                            SHA1

                                                                            b8e86446e5ff4d10984af769b912d8d34313da54

                                                                            SHA256

                                                                            0d0b29673b1fcaea71df3130c5c5cf31a8f8bbd16b60f9861b4a42665c934493

                                                                            SHA512

                                                                            bc0ca2e71bcc7f3680c683f91a87204d614f4bac56750619f449194f6aa69d983f526b4f73a5fed083ad56d648dfcce3a80c25b93fd07e76b616f14b219b6f04

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\BF253\3CCA.F25
                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            652f8fb0ab21e2163ac86a7555bad336

                                                                            SHA1

                                                                            461ff9f872aa73ad4b7e8a7387d629e88a1188b2

                                                                            SHA256

                                                                            ebbda06d5b9d3a32808287f1aaa57488d2493aa6cf3ad01ec2d1119be6882a6e

                                                                            SHA512

                                                                            afd1e9d0a00fe274ced7b6287ead780e0df87562acabbce35e6f795f0f0f76b6fd488d969294b09425fa6a741830d2d2bf8c3dd4f13d953b01b08541a06d85bd

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\BF253\3CCA.F25
                                                                            Filesize

                                                                            600B

                                                                            MD5

                                                                            091856f84e8ae7df2e32ad678a107f12

                                                                            SHA1

                                                                            331b421ad1bb348034e99aef92119f7fadf790f0

                                                                            SHA256

                                                                            6f8f1187a802ca89c0c8597281c31b4d2d41594eeefd3ac0186be7a3d1008d1c

                                                                            SHA512

                                                                            cc6d921119cc01f873814fc9b625e28fe30397a95e32af9b0fa4203a9755be7559422ade57e322dd729f9f87fa634285f169ac468cd0f4fd2657dba9ae22d82f

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\BF253\3CCA.F25
                                                                            Filesize

                                                                            996B

                                                                            MD5

                                                                            47051f8c51f26df43c4f6d6700838d73

                                                                            SHA1

                                                                            0947ef02460056d3e42145ac181843a7e12bb226

                                                                            SHA256

                                                                            e98055b56b2cd7137bce7dc2dcb2ae73fcee997ed60d92c879bc88af82c9380e

                                                                            SHA512

                                                                            1baeb332301e35c88d25a03d9515882bb9a45ce602fa7bb4b02d36abee4ca6f2c1801d8c30b5e72e680a40f6f452e2dc631d1ef3347351867a5250046980780d

                                                                            Download Submit

                                                                          • memory/532-920-0x0000000004180000-0x0000000004181000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/656-661-0x000001D1856D0000-0x000001D1856F0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/656-672-0x000001D185690000-0x000001D1856B0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/656-692-0x000001D185CA0000-0x000001D185CC0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/660-14-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                            Filesize

                                                                            424KB

                                                                            Download

                                                                          • memory/660-16-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                            Filesize

                                                                            424KB

                                                                            Download

                                                                          • memory/660-15-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                            Filesize

                                                                            424KB

                                                                            Download

                                                                          • memory/1064-107-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                            Filesize

                                                                            424KB

                                                                            Download

                                                                          • memory/1644-529-0x000001FAB6D50000-0x000001FAB6D70000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/1644-519-0x000001FAB6940000-0x000001FAB6960000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/1644-506-0x000001FAB6980000-0x000001FAB69A0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/1708-1225-0x0000020B16660000-0x0000020B16680000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/1708-1250-0x0000020B16620000-0x0000020B16640000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/1708-1256-0x0000020B16A20000-0x0000020B16A40000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/2168-959-0x000001F66BC40000-0x000001F66BC60000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/2168-928-0x000001F66B870000-0x000001F66B890000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/2168-941-0x000001F66B830000-0x000001F66B850000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/2264-1524-0x000001BDDF100000-0x000001BDDF200000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/2264-1529-0x000001BDE0400000-0x000001BDE0420000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/2264-1549-0x000001BDE07D0000-0x000001BDE07F0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/2264-1538-0x000001BDE01C0000-0x000001BDE01E0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/2564-653-0x0000000003440000-0x0000000003441000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/3132-802-0x0000017046100000-0x0000017046200000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/3132-816-0x00000170471B0000-0x00000170471D0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3132-828-0x00000170475C0000-0x00000170475E0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3132-800-0x0000017046100000-0x0000017046200000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/3132-805-0x00000170471F0000-0x0000017047210000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3132-801-0x0000017046100000-0x0000017046200000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/3192-1068-0x0000000003FF0000-0x0000000003FF1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/3248-499-0x0000000003E40000-0x0000000003E41000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/3512-1215-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                            Filesize

                                                                            424KB

                                                                            Download

                                                                          • memory/3512-3-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                            Filesize

                                                                            424KB

                                                                            Download

                                                                          • memory/3512-108-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                            Filesize

                                                                            424KB

                                                                            Download

                                                                          • memory/3512-342-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                            Filesize

                                                                            424KB

                                                                            Download

                                                                          • memory/3512-4-0x0000000000400000-0x0000000000467000-memory.dmp

                                                                            Filesize

                                                                            412KB

                                                                            Download

                                                                          • memory/3512-1-0x0000000000400000-0x0000000000467000-memory.dmp

                                                                            Filesize

                                                                            412KB

                                                                            Download

                                                                          • memory/3512-17-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                            Filesize

                                                                            424KB

                                                                            Download

                                                                          • memory/3512-2-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                            Filesize

                                                                            424KB

                                                                            Download

                                                                          • memory/3540-798-0x0000000004540000-0x0000000004541000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/3684-1217-0x0000000004370000-0x0000000004371000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/3940-1369-0x00000000048C0000-0x00000000048C1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4088-127-0x0000000003410000-0x0000000003411000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4344-1522-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4564-1377-0x0000028721280000-0x00000287212A0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4564-1406-0x0000028721650000-0x0000028721670000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4564-1391-0x0000028721240000-0x0000028721260000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4576-144-0x000001BD51F40000-0x000001BD51F60000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4576-130-0x000001B54FE20000-0x000001B54FF20000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/4576-129-0x000001B54FE20000-0x000001B54FF20000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/4576-133-0x000001BD51F80000-0x000001BD51FA0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4576-164-0x000001BD52350000-0x000001BD52370000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4576-128-0x000001B54FE20000-0x000001B54FF20000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/4704-343-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                            Filesize

                                                                            112KB

                                                                            Download

                                                                          • memory/4740-1076-0x000001220D040000-0x000001220D060000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4740-1088-0x000001220D000000-0x000001220D020000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4740-1102-0x000001220D410000-0x000001220D430000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/5028-346-0x0000000002D60000-0x0000000002D61000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/5088-383-0x000001FD383A0000-0x000001FD383C0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/5088-365-0x000001FD37F90000-0x000001FD37FB0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/5088-353-0x000001FD37FD0000-0x000001FD37FF0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/5088-349-0x000001FD36F00000-0x000001FD37000000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/5088-348-0x000001FD36F00000-0x000001FD37000000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download