Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

d772089c64...18.exe

windows7-x64

10

d772089c64...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    86s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/09/2024, 02:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d772089c64fd321e88dba042688c2c79_JaffaCakes118.exe

  • Size

    263KB

  • MD5

    d772089c64fd321e88dba042688c2c79

  • SHA1

    f04d764228543960458ea202a98367f5ca2556d2

  • SHA256

    8d3e9dceb061652f03b0b89c6d98ad4e61e2b2fc2036163776a8c24607be9bcc

  • SHA512

    d101bb43b11364d1aaa118dc2e7bfe10d88f0411e4e27c498a8c3cbf9c349c3593349a58354c6c1f9775a187601d7581ce1525f3a307b11e350e665b5534464a

  • SSDEEP

    6144:m12GcL7LVE72xZlDS0Bo4tgoPZPomcgHwbaA61PESw:m1g7L+sTDS0i4OchVnHG61PES

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 14 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 28 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 26 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\d772089c64fd321e88dba042688c2c79_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d772089c64fd321e88dba042688c2c79_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2128
    • C:\Users\Admin\AppData\Local\Temp\d772089c64fd321e88dba042688c2c79_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d772089c64fd321e88dba042688c2c79_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\58230\8CCA0.exe%C:\Users\Admin\AppData\Roaming\58230
      2⤵
        PID:5060
      • C:\Users\Admin\AppData\Local\Temp\d772089c64fd321e88dba042688c2c79_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\d772089c64fd321e88dba042688c2c79_JaffaCakes118.exe startC:\Program Files (x86)\30456\lvvm.exe%C:\Program Files (x86)\30456
        2⤵
          PID:4140
        • C:\Program Files (x86)\LP\A035\7E05.tmp
          "C:\Program Files (x86)\LP\A035\7E05.tmp"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4064
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:728
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4648
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1844
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3720
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4812
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:5088
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4200
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3172
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:4304
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4724
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:752
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:2788
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3356
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3708
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:320
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3636
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3812
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        PID:3332
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4960
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2440
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:1484
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3460
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5096
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:220
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4580
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1840
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4524
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1540
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4512
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:5016
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3024
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4432
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4736
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3148
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2400
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:708
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3952
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4580
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        PID:3444
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1264
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2256
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:4284
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:3920
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3540
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4268
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:4888
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:4032
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:1980
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:2588
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:376
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:4088
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:864
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:2176
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4816
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:3304
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:4280
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:2184
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:2300
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:4492
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:1192
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:4312
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:5016
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:4892
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:1884
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:3004
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:4992
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:3892
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:1660
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:3064
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:4436
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:3816
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:4280
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:3148

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v15

                                                                      Reconnaissance

                                                                      Resource Development

                                                                      Initial Access

                                                                      Execution

                                                                      Persistence

                                                                      Boot or Logon Autostart Execution

                                                                      2
                                                                      T1547

                                                                      Active Setup

                                                                      1
                                                                      T1547.014

                                                                      Registry Run Keys / Startup Folder

                                                                      1
                                                                      T1547.001

                                                                      Create or Modify System Process

                                                                      1
                                                                      T1543

                                                                      Windows Service

                                                                      1
                                                                      T1543.003

                                                                      Privilege Escalation

                                                                      Boot or Logon Autostart Execution

                                                                      2
                                                                      T1547

                                                                      Active Setup

                                                                      1
                                                                      T1547.014

                                                                      Registry Run Keys / Startup Folder

                                                                      1
                                                                      T1547.001

                                                                      Create or Modify System Process

                                                                      1
                                                                      T1543

                                                                      Windows Service

                                                                      1
                                                                      T1543.003

                                                                      Defense Evasion

                                                                      Modify Registry

                                                                      5
                                                                      T1112

                                                                      Credential Access

                                                                      Credentials from Password Stores

                                                                      1
                                                                      T1555

                                                                      Credentials from Web Browsers

                                                                      1
                                                                      T1555.003

                                                                      Unsecured Credentials

                                                                      3
                                                                      T1552

                                                                      Credentials In Files

                                                                      3
                                                                      T1552.001

                                                                      Discovery

                                                                      Peripheral Device Discovery

                                                                      2
                                                                      T1120

                                                                      Query Registry

                                                                      4
                                                                      T1012

                                                                      System Information Discovery

                                                                      2
                                                                      T1082

                                                                      System Location Discovery

                                                                      1
                                                                      T1614

                                                                      System Language Discovery

                                                                      1
                                                                      T1614.001

                                                                      Lateral Movement

                                                                      Collection

                                                                      Data from Local System

                                                                      2
                                                                      T1005

                                                                      Command and Control

                                                                      Exfiltration

                                                                      Impact

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Program Files (x86)\LP\A035\7E05.tmp
                                                                        Filesize

                                                                        94KB

                                                                        MD5

                                                                        7c038627f6f9ccd7964a25dce79530f7

                                                                        SHA1

                                                                        bbb30bf608847506511832eefd3270e755428848

                                                                        SHA256

                                                                        1ce8efa02f5a3a9fe57228e06eb8a872bd47068730959d845622956df7cfb101

                                                                        SHA512

                                                                        2692241f367013ff59b9671977b6f42e51a7c130280b978cf132d457ffac4e05a512e4368f9b2c3b2cfc09636d2eb6df26761111fcab5b8320711c6d9a85687b

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                        Filesize

                                                                        471B

                                                                        MD5

                                                                        fb6d48dad9b7772689e7f825b3774772

                                                                        SHA1

                                                                        be3ec403f876cc98263290a8fd1c1b5e55649098

                                                                        SHA256

                                                                        d21e170115828f1cab36a101f06c2212596bfbc6bcdae8ec2cf34e48fbbe6f19

                                                                        SHA512

                                                                        ac808ab2652e911fea4a3177102bca8e24245be005e49960c8dbce32a061c264551e33bbf7396ad120342d7e7fc9d8d9c9bcbbd182a5537d803b6cc18de63afe

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                        Filesize

                                                                        420B

                                                                        MD5

                                                                        f53ba286feade4acfbbcea89ec3a6e6c

                                                                        SHA1

                                                                        5db2d5f5bf05501d5d99b10bc77273dfd4d95e2f

                                                                        SHA256

                                                                        b237e6cb9319b4107d7f0862fe1165b4212693831d056a3aa624f33a16a4e5af

                                                                        SHA512

                                                                        3be9be276cbdcf3cdf6c50faad8b31c94e0c97f58638840dd2bfa13cf94f80e06d5ae68ed49f6d2dc055ffe96aadfabfb19d4b2c1fd89b3321830f9da70e1cd9

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                        Filesize

                                                                        2KB

                                                                        MD5

                                                                        57e7ef95b86bc52c061aa21694198cad

                                                                        SHA1

                                                                        54b91c9fd71d4902690bce7e3cdb666623ff59d1

                                                                        SHA256

                                                                        71384854e30e01db4f227b9bc8eccc91c40cdaa67cda982c0082cd4d46e7e03a

                                                                        SHA512

                                                                        4eb65893d80abf795ffc03debea6720e948ad20a9a5d6de85849a6d1146594d68fc25813e8c314150db71b342060e566d4a20bf740fec39bd67cd61744c3bee5

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
                                                                        Filesize

                                                                        36KB

                                                                        MD5

                                                                        0e2a09c8b94747fa78ec836b5711c0c0

                                                                        SHA1

                                                                        92495421ad887f27f53784c470884802797025ad

                                                                        SHA256

                                                                        0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                        SHA512

                                                                        61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
                                                                        Filesize

                                                                        36KB

                                                                        MD5

                                                                        ab0262f72142aab53d5402e6d0cb5d24

                                                                        SHA1

                                                                        eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                        SHA256

                                                                        20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                        SHA512

                                                                        bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Y25IPP08\microsoft.windows[1].xml
                                                                        Filesize

                                                                        97B

                                                                        MD5

                                                                        d07a8eeeb6da833c3c127ff207daead9

                                                                        SHA1

                                                                        cc8a12f7c600ac6ad8211f50045ca376f88f3cb6

                                                                        SHA256

                                                                        113038e3d15cda4a50c0980cb7075456d00b0770a1c436b68cea36b435363392

                                                                        SHA512

                                                                        84bac1ea9a2bac093a6356933b08c841d1ef922937d05db05b388b6b107d77a7edcf6431db083a89e611c86c2ed9e8e83207e798edb08e3e056045780a432800

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Roaming\58230\0456.823
                                                                        Filesize

                                                                        600B

                                                                        MD5

                                                                        578b52c1ab532d4a358ac08672ac3d17

                                                                        SHA1

                                                                        b75a4aed89e624d35d6e20354a26ea70a2ffcc61

                                                                        SHA256

                                                                        b0723276dc0664b28deb535163b34ee04fc1448ab0dd62752a9ced4c98efddbe

                                                                        SHA512

                                                                        c3880177009c6876c9da9e7cfd6a3c359d64e897e17eb91344a37d84f5b33d04a3cfdfc1cd3da6698d18f43788646fe5ff6d33e3a738f180b7f0311526ecf43b

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Roaming\58230\0456.823
                                                                        Filesize

                                                                        996B

                                                                        MD5

                                                                        ac7a39dcd55b0b0c25f5b2b29fe38211

                                                                        SHA1

                                                                        14af513dd7d205154e8777c4c464b7af9a920b27

                                                                        SHA256

                                                                        5dba11efd2e163b1b3e6ce36cd3520d4a5459db6b3bd7c27534f41da6f7cf0cd

                                                                        SHA512

                                                                        53f7e4166c4b4504478a9ccb312a4c2ad3d5fe4639342b9221a709f4fce06a163d3ae2c8a7c440f41ab520f32ab0df129518934ebbadb2e6ce76742da481ddfd

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Roaming\58230\0456.823
                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        8758258ccdf24894b00928900103e197

                                                                        SHA1

                                                                        132a0ee09903dde3de48a86aacbf876d3ddec5db

                                                                        SHA256

                                                                        5cb52c67aaad569f118864516f9506fff1bc36432482c53e92b32be5f7b38646

                                                                        SHA512

                                                                        8a2a7580c40401d6c75459f7bbda567626a8209c1fe10f8bd497fa2b9cead142257ee8b8ed95800c9572b5bcf7fa043b59ab418b00b302f6318cc4d9be08316f

                                                                        Download Submit

                                                                      • memory/220-1210-0x0000000004160000-0x0000000004161000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/320-760-0x0000000002A40000-0x0000000002A41000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/752-484-0x00000148E6200000-0x00000148E6220000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/752-473-0x00000148E6240000-0x00000148E6260000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/752-504-0x00000148E6610000-0x00000148E6630000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/1484-1060-0x0000000004E40000-0x0000000004E41000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/1840-1218-0x0000028D46290000-0x0000028D462B0000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/1840-1229-0x0000028D46250000-0x0000028D46270000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/1840-1241-0x0000028D46860000-0x0000028D46880000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/2128-3-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                        Filesize

                                                                        416KB

                                                                        Download

                                                                      • memory/2128-614-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                        Filesize

                                                                        416KB

                                                                        Download

                                                                      • memory/2128-130-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                        Filesize

                                                                        416KB

                                                                        Download

                                                                      • memory/2128-17-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                        Filesize

                                                                        408KB

                                                                        Download

                                                                      • memory/2128-13-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                        Filesize

                                                                        416KB

                                                                        Download

                                                                      • memory/2128-2-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                        Filesize

                                                                        408KB

                                                                        Download

                                                                      • memory/2128-0-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                        Filesize

                                                                        416KB

                                                                        Download

                                                                      • memory/2128-1504-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                        Filesize

                                                                        416KB

                                                                        Download

                                                                      • memory/2440-912-0x000002B8EAD00000-0x000002B8EAE00000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/2440-947-0x000002B8EC1C0000-0x000002B8EC1E0000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/2440-915-0x000002B8EBE00000-0x000002B8EBE20000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/2440-924-0x000002B8EBBB0000-0x000002B8EBBD0000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/2440-910-0x000002B8EAD00000-0x000002B8EAE00000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/2788-613-0x0000000004520000-0x0000000004521000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/3172-338-0x000001C53EF70000-0x000001C53EF90000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/3172-307-0x000001C53EBA0000-0x000001C53EBC0000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/3172-322-0x000001C53EB60000-0x000001C53EB80000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/3332-908-0x00000000048D0000-0x00000000048D1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/3708-621-0x000002336EA90000-0x000002336EAB0000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/3708-616-0x000002336DB40000-0x000002336DC40000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/3708-618-0x000002336DB40000-0x000002336DC40000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/3708-633-0x000002336EA50000-0x000002336EA70000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/3708-645-0x000002336F060000-0x000002336F080000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/3708-617-0x000002336DB40000-0x000002336DC40000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/3812-761-0x000001ABAEF00000-0x000001ABAF000000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/3812-766-0x000001B3B1000000-0x000001B3B1020000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/3812-762-0x000001ABAEF00000-0x000001ABAF000000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/3812-776-0x000001B3B0DB0000-0x000001B3B0DD0000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/3812-789-0x000001B3B13C0000-0x000001B3B13E0000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/3812-763-0x000001ABAEF00000-0x000001ABAF000000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/4064-611-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                        Filesize

                                                                        108KB

                                                                        Download

                                                                      • memory/4140-132-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                        Filesize

                                                                        416KB

                                                                        Download

                                                                      • memory/4304-466-0x00000000042A0000-0x00000000042A1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/4432-1512-0x0000020153460000-0x0000020153480000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/4432-1509-0x0000020152300000-0x0000020152400000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/4432-1508-0x0000020152300000-0x0000020152400000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/4512-1365-0x0000018E43C00000-0x0000018E43D00000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/4512-1393-0x0000018E450E0000-0x0000018E45100000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/4512-1382-0x0000018E449D0000-0x0000018E449F0000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/4512-1364-0x0000018E43C00000-0x0000018E43D00000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/4512-1366-0x0000018E43C00000-0x0000018E43D00000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/4512-1369-0x0000018E44D20000-0x0000018E44D40000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/4524-1362-0x0000000004E60000-0x0000000004E61000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/5016-1505-0x0000000004750000-0x0000000004751000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/5060-16-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                        Filesize

                                                                        416KB

                                                                        Download

                                                                      • memory/5060-15-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                        Filesize

                                                                        416KB

                                                                        Download

                                                                      • memory/5088-300-0x00000000036A0000-0x00000000036A1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/5096-1080-0x000001B841030000-0x000001B841050000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/5096-1062-0x000001B83FF20000-0x000001B840020000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/5096-1098-0x000001B841440000-0x000001B841460000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/5096-1067-0x000001B841070000-0x000001B841090000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/5096-1064-0x000001B83FF20000-0x000001B840020000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/5096-1063-0x000001B83FF20000-0x000001B840020000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download