Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

d668148d1a...18.exe

windows7-x64

7

d668148d1a...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    57s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/09/2024, 13:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d668148d1a59d45cb510101313e9dfc0_JaffaCakes118.exe

  • Size

    134KB

  • MD5

    d668148d1a59d45cb510101313e9dfc0

  • SHA1

    b54578f109ab1be96c114db86e2639a9356aa2bb

  • SHA256

    177510a95f2bd9c4584c3c5dd536ca71f517b3d5767abc2fcf177ef29f83369f

  • SHA512

    b460dcca0e32d0f627685988965cec9fb2e1ffa40558535f42cdcdd3f4b2b2d94ff9150dad17ecc1227175b6ff991afd9765f82975f3b9596d59988f94dd362f

  • SSDEEP

    3072:TUX8z0IKAXAZEH6Gg7M4o6Y43uzljWFq8j2y:ToE0IcmiA4J3uzlS08j2

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 11 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\d668148d1a59d45cb510101313e9dfc0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d668148d1a59d45cb510101313e9dfc0_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2744
    • C:\Windows\SysWOW64\EXPL0RER.EXE
      "C:\Windows\system32\EXPL0RER.EXE" "C:\Users\Admin\AppData\Local\Temp\d668148d1a59d45cb510101313e9dfc0_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:212
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1760
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1844
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3360
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1556
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5044
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    PID:2860
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2416
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2460
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of SendNotifyMessage
    PID:5044
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1836
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2852
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3112
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3728
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4152
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2472
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1908
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1344
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4576
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3456
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3920
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4880
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3132
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4148
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1640
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5004
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3460
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3860
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:924
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3132
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:692
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:4612
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
      PID:5012
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:3744
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:3960
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:1640
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:4660
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:4696
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:4876
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:3640
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:1028
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:3132
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:4872
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:3892
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:4680
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:5012
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:1840
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:2560
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:3580
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:4152
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:4420
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:1712
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:3052
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:3384
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:1716
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:808
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:1396
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:3868
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:4052
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:4332
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:4048
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:4736
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:1516
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:3796
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:984
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:368
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:1236
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:4172
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:516
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:4100
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:3468
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:2128
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:2152
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:3424
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:980
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:1640
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:3320
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:3020
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:3812
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                  1⤵
                                                                                                    PID:4416

                                                                                                  Network

                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                  Replay Monitor

                                                                                                  Loading Replay Monitor...

                                                                                                  Downloads

                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                    Filesize

                                                                                                    471B

                                                                                                    MD5

                                                                                                    fb6d48dad9b7772689e7f825b3774772

                                                                                                    SHA1

                                                                                                    be3ec403f876cc98263290a8fd1c1b5e55649098

                                                                                                    SHA256

                                                                                                    d21e170115828f1cab36a101f06c2212596bfbc6bcdae8ec2cf34e48fbbe6f19

                                                                                                    SHA512

                                                                                                    ac808ab2652e911fea4a3177102bca8e24245be005e49960c8dbce32a061c264551e33bbf7396ad120342d7e7fc9d8d9c9bcbbd182a5537d803b6cc18de63afe

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                    Filesize

                                                                                                    420B

                                                                                                    MD5

                                                                                                    99c67e7d07b3823d3bd53997da07b01e

                                                                                                    SHA1

                                                                                                    c25e92481b9ff45a180da97383b61821d6ee6ccb

                                                                                                    SHA256

                                                                                                    5a3b832af0793c8f28ca73c715b434d9c08a6c73ae64a520608b8fbf49b04a23

                                                                                                    SHA512

                                                                                                    4e96cb9f0cf2cbb40ba7129f720c43e8cde3cab1614b29d72291a81f3ce5fc10311d8db3b9046ce0203d61cf2a3d7a36618fb93ade4dfe7dfd982b564d6c3383

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    2bbb1a19bd03fa6da10e5842e4ba8b87

                                                                                                    SHA1

                                                                                                    24ddf8eb25c370532ec4174c452e086435a12449

                                                                                                    SHA256

                                                                                                    6a5b94f5c9db3999f7e385b0a1f88b5a744cb0c276d33e6adcb2a94022ea4b81

                                                                                                    SHA512

                                                                                                    7dd185991b5ac7b02ad39ca470f1e115d7ce90ea1a96ec92f514748e30c12b28606b4152185243d87d91fe4b95aeed3c88dab937a2f174595321d8b0f50de344

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
                                                                                                    Filesize

                                                                                                    36KB

                                                                                                    MD5

                                                                                                    0e2a09c8b94747fa78ec836b5711c0c0

                                                                                                    SHA1

                                                                                                    92495421ad887f27f53784c470884802797025ad

                                                                                                    SHA256

                                                                                                    0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                                                    SHA512

                                                                                                    61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
                                                                                                    Filesize

                                                                                                    36KB

                                                                                                    MD5

                                                                                                    ab0262f72142aab53d5402e6d0cb5d24

                                                                                                    SHA1

                                                                                                    eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                                                    SHA256

                                                                                                    20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                                                    SHA512

                                                                                                    bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\BL9O2ALU\microsoft.windows[1].xml
                                                                                                    Filesize

                                                                                                    96B

                                                                                                    MD5

                                                                                                    71e0980a20933bf598e12d709b1f1a5d

                                                                                                    SHA1

                                                                                                    3d6f67f9eff69f233b551cf8f07fa6800974dc5a

                                                                                                    SHA256

                                                                                                    4266cb485dd87059ba81a2bc515a3ef64d051827c11a9ef5a4307d665965142e

                                                                                                    SHA512

                                                                                                    051df6f8285a96da086e45a2a09fe9552c1577ccf1e6529975eb94c27578e95bb3701fde098721ed309db7de67cb837063d4a052d16613b554b5e51574b243ca

                                                                                                    Download Submit

                                                                                                  • C:\Windows\SysWOW64\EXPL0RER.EXE
                                                                                                    Filesize

                                                                                                    134KB

                                                                                                    MD5

                                                                                                    d668148d1a59d45cb510101313e9dfc0

                                                                                                    SHA1

                                                                                                    b54578f109ab1be96c114db86e2639a9356aa2bb

                                                                                                    SHA256

                                                                                                    177510a95f2bd9c4584c3c5dd536ca71f517b3d5767abc2fcf177ef29f83369f

                                                                                                    SHA512

                                                                                                    b460dcca0e32d0f627685988965cec9fb2e1ffa40558535f42cdcdd3f4b2b2d94ff9150dad17ecc1227175b6ff991afd9765f82975f3b9596d59988f94dd362f

                                                                                                    Download Submit

                                                                                                  • memory/212-36-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                    Filesize

                                                                                                    160KB

                                                                                                    Download

                                                                                                  • memory/924-1120-0x000001B0E8080000-0x000001B0E80A0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/924-1085-0x000001B0E6B40000-0x000001B0E6C40000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/924-1089-0x000001B0E7AA0000-0x000001B0E7AC0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/924-1084-0x000001B0E6B40000-0x000001B0E6C40000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/924-1102-0x000001B0E7A60000-0x000001B0E7A80000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/1344-642-0x00000000044D0000-0x00000000044D1000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/2460-210-0x000001FA25650000-0x000001FA25670000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/2460-201-0x000001FA25690000-0x000001FA256B0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/2460-197-0x000001FA24740000-0x000001FA24840000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/2460-233-0x000001FA25C60000-0x000001FA25C80000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/2460-196-0x000001FA24740000-0x000001FA24840000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/2744-35-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                    Filesize

                                                                                                    160KB

                                                                                                    Download

                                                                                                  • memory/2852-347-0x000002C925020000-0x000002C925120000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/2852-346-0x000002C925020000-0x000002C925120000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/2852-351-0x000002C926170000-0x000002C926190000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/2852-361-0x000002C926130000-0x000002C926150000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/2852-382-0x000002C926540000-0x000002C926560000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/2860-195-0x0000000002730000-0x0000000002731000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/3112-497-0x00000000044B0000-0x00000000044B1000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/3132-829-0x000001C31EBA0000-0x000001C31EBC0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3132-1235-0x0000000004780000-0x0000000004781000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/3132-798-0x000001C31E7D0000-0x000001C31E7F0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3132-807-0x000001C31E790000-0x000001C31E7B0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3360-47-0x0000000004F20000-0x0000000004F21000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/3456-644-0x000001F90D500000-0x000001F90D600000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/3456-672-0x000001F90E9C0000-0x000001F90E9E0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3456-661-0x000001F90E5B0000-0x000001F90E5D0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3456-649-0x000001F90E5F0000-0x000001F90E610000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3456-645-0x000001F90D500000-0x000001F90D600000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/3460-1082-0x00000000042B0000-0x00000000042B1000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/3920-790-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/3960-1376-0x0000028D6B740000-0x0000028D6B840000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/3960-1375-0x0000028D6B740000-0x0000028D6B840000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/3960-1380-0x0000028D6C690000-0x0000028D6C6B0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/4148-939-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/4152-535-0x00000223AC220000-0x00000223AC240000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/4152-504-0x00000223ABE60000-0x00000223ABE80000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/4152-513-0x00000223ABE20000-0x00000223ABE40000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/4612-1236-0x000001C146C00000-0x000001C146D00000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/4612-1251-0x000001C147AA0000-0x000001C147AC0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/4612-1237-0x000001C146C00000-0x000001C146D00000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/4612-1241-0x000001C147AE0000-0x000001C147B00000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/4612-1264-0x000001C1480C0000-0x000001C1480E0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/5004-943-0x00000232DBD50000-0x00000232DBE50000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/5004-946-0x00000232DCCB0000-0x00000232DCCD0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/5004-958-0x00000232DCC70000-0x00000232DCC90000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/5004-942-0x00000232DBD50000-0x00000232DBE50000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/5004-941-0x00000232DBD50000-0x00000232DBE50000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/5004-978-0x00000232DD280000-0x00000232DD2A0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/5012-1373-0x0000000004D50000-0x0000000004D51000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/5044-48-0x00000284C3360000-0x00000284C3460000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/5044-49-0x00000284C3360000-0x00000284C3460000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/5044-53-0x00000284C40C0000-0x00000284C40E0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/5044-74-0x00000284C48A0000-0x00000284C48C0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/5044-62-0x00000284C4080000-0x00000284C40A0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/5044-344-0x0000000004B80000-0x0000000004B81000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download