Overview

overview

10

Static

static

3

d79ce7a438...18.exe

windows7-x64

10

d79ce7a438...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    83s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-09-2024 04:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d79ce7a4383a22b42527e4e3271663cb_JaffaCakes118.exe

  • Size

    265KB

  • MD5

    d79ce7a4383a22b42527e4e3271663cb

  • SHA1

    6435b07c4c203dabd75c993b27cd2616f0ade7c9

  • SHA256

    6f45cb68bb37d81e2118468233bca43cfe92add46d8595ef34f55102b07fe2cc

  • SHA512

    702bac42993a474ad949375c9f79a6ee0ee5fe0f1ad042d0016ab6c9fb23ab2e2ef739cb86395f2d0be086700f54402517fcbad35de755d5b3d45e76872bc2da

  • SSDEEP

    6144:TTp+zLPpMCXYpUwVtyVVGqkibrcav/DBxYNWTjCPSfl:hyLPp5I1+1kOrcasNWTjCPU

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 13 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\d79ce7a4383a22b42527e4e3271663cb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d79ce7a4383a22b42527e4e3271663cb_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3792
    • C:\Users\Admin\AppData\Local\Temp\d79ce7a4383a22b42527e4e3271663cb_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d79ce7a4383a22b42527e4e3271663cb_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\6E9AF\1A99D.exe%C:\Users\Admin\AppData\Roaming\6E9AF
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1628
    • C:\Users\Admin\AppData\Local\Temp\d79ce7a4383a22b42527e4e3271663cb_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d79ce7a4383a22b42527e4e3271663cb_JaffaCakes118.exe startC:\Program Files (x86)\AFA95\lvvm.exe%C:\Program Files (x86)\AFA95
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1700
    • C:\Program Files (x86)\LP\9D16\2BAF.tmp
      "C:\Program Files (x86)\LP\9D16\2BAF.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4084
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1592
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4788
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4380
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3496
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3312
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4428
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:3824
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:868
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4536
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:5076
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3240
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:720
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4484
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4684
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1188
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4308
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:624
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3336
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:4300
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3048
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4108
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3624
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3032
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2624
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4556
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3248
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2492
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2508
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3088
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2544
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1240
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3680
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:208
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1316
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4380
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2888
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3128
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:1640
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:3240
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:4280
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:3584
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:2584
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4204
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:716
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:3456
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:1868
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:4364
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:3532
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:3604
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:2756
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:4072
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4628
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:1212
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:3712
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:4248
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:1648
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:5096
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:1704
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:4312
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:3292
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:1652
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:2328
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:4020
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:1656
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:4736
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:4816
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:3512
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:4404
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:4760
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:4816
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:1904
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:5032
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:1648
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:3844
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:1556

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v15

                                                                              Reconnaissance

                                                                              Resource Development

                                                                              Initial Access

                                                                              Execution

                                                                              Persistence

                                                                              Boot or Logon Autostart Execution

                                                                              2
                                                                              T1547

                                                                              Active Setup

                                                                              1
                                                                              T1547.014

                                                                              Registry Run Keys / Startup Folder

                                                                              1
                                                                              T1547.001

                                                                              Create or Modify System Process

                                                                              1
                                                                              T1543

                                                                              Windows Service

                                                                              1
                                                                              T1543.003

                                                                              Privilege Escalation

                                                                              Boot or Logon Autostart Execution

                                                                              2
                                                                              T1547

                                                                              Active Setup

                                                                              1
                                                                              T1547.014

                                                                              Registry Run Keys / Startup Folder

                                                                              1
                                                                              T1547.001

                                                                              Create or Modify System Process

                                                                              1
                                                                              T1543

                                                                              Windows Service

                                                                              1
                                                                              T1543.003

                                                                              Defense Evasion

                                                                              Modify Registry

                                                                              5
                                                                              T1112

                                                                              Credential Access

                                                                              Credentials from Password Stores

                                                                              1
                                                                              T1555

                                                                              Credentials from Web Browsers

                                                                              1
                                                                              T1555.003

                                                                              Unsecured Credentials

                                                                              3
                                                                              T1552

                                                                              Credentials In Files

                                                                              3
                                                                              T1552.001

                                                                              Discovery

                                                                              Peripheral Device Discovery

                                                                              2
                                                                              T1120

                                                                              Query Registry

                                                                              4
                                                                              T1012

                                                                              System Information Discovery

                                                                              2
                                                                              T1082

                                                                              System Location Discovery

                                                                              1
                                                                              T1614

                                                                              System Language Discovery

                                                                              1
                                                                              T1614.001

                                                                              Lateral Movement

                                                                              Collection

                                                                              Data from Local System

                                                                              2
                                                                              T1005

                                                                              Command and Control

                                                                              Exfiltration

                                                                              Impact

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • C:\Program Files (x86)\LP\9D16\2BAF.tmp
                                                                                Filesize

                                                                                96KB

                                                                                MD5

                                                                                080cae9ef700f641fc28c7907a5f6b0e

                                                                                SHA1

                                                                                bbc8e5bcc20c05a189c0c889da7c47ba914448b3

                                                                                SHA256

                                                                                d15cc7e649cb202989b47709830c6ec7764a4cf6ec41bec408adc2c58474a7a9

                                                                                SHA512

                                                                                83e452cc41b276ea19a7882d10cbda80216cffd9c68de34571bc03eff6aaaf48fecf242083fdfb2d0af7543a779a894698168f7c2fde49910ba27da8c0bd8d76

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                Filesize

                                                                                471B

                                                                                MD5

                                                                                d625606b952644a70d5698dd34bd14b8

                                                                                SHA1

                                                                                a230ca74d94a8191ff13fdd8501f4bceb61131a9

                                                                                SHA256

                                                                                d5ba357a39c42632cf50fd5d9bcb15670e84f28a6dfa70ca7d38862e1ca4cb23

                                                                                SHA512

                                                                                ef4382bc36f0f358b489a27488fba8743c77f74f53e9182a204d942b08ebdc0e703ce0ad065a9f80ea20df0f35b870ad7ad06a8ef31274cc0c727c44473efa71

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                Filesize

                                                                                420B

                                                                                MD5

                                                                                0e58320f47af8f30a8e6fb395b17b95b

                                                                                SHA1

                                                                                a6c00e20c22e4dc0aa7a314ea6bc8749b16de625

                                                                                SHA256

                                                                                427f3db1612d7516eb52d66fb9e69710886c8fea56d5d487c134a3252d066c81

                                                                                SHA512

                                                                                a25a9f9bab535ca3d0e7efc3fedb9ebd475bd1d4aaed54701ed7cc0c68081f5e07e1e0675538671865059cda2d090d59911694f3fe2e99c22d6e1681464842b7

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                18a205721585d77b937d1b1df1ff4f23

                                                                                SHA1

                                                                                a8048a3dad8a9ea96623292669969d1598602c44

                                                                                SHA256

                                                                                e9459ac46a2f14f687b6040551e392a05aa866b9cbaa69c609466ec8b7ba706e

                                                                                SHA512

                                                                                a97af8c109b4803a380a63592f75ec50119ec12820cdb5d6e556f9efa93b7215b42f08c4f38f1dca0780368a1905a8cae8c041a2da1aa17ec3579d14697106c3

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1EALJNKU\microsoft.windows[1].xml
                                                                                Filesize

                                                                                97B

                                                                                MD5

                                                                                e9474f76e56e4f8298ed32d85776ddc0

                                                                                SHA1

                                                                                85b5c1919bb4fe74dc30b4dd0911d1994dd0974f

                                                                                SHA256

                                                                                b62242af1adf03ea40e4dff979f8b28430afebd75f7bf0e04a54745a47972c61

                                                                                SHA512

                                                                                7b1b354c53b204e1ac9b9fba462dd2474cedf64607be42d5865ca2dca611b9b2224ed84ff696978d1ac35adccb2f2199111dffcf54cd4189dc5b989678b55ab6

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Roaming\6E9AF\FA95.E9A
                                                                                Filesize

                                                                                996B

                                                                                MD5

                                                                                22f60edb2be1420ae69234dc4b07ab97

                                                                                SHA1

                                                                                15e8d2e32d0b0a00a9481db12e3987f77bfe779f

                                                                                SHA256

                                                                                6881b2aa5c89b9abfb7c46e2f2f8eab4027be1e100eab8c1a9d5e5ae62084725

                                                                                SHA512

                                                                                9d07bf40242be3ea9c863c9d40d31b9b4842af793cb1f5c867c1a7ede521fa258aed45c532b12119b6b553a34777ba0548f04c68c6a6a4af5fa4228dd35f196a

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Roaming\6E9AF\FA95.E9A
                                                                                Filesize

                                                                                600B

                                                                                MD5

                                                                                c3c70def67faf7d09c25a12edf12d5d4

                                                                                SHA1

                                                                                ec02f6f6482fd9a95323c4bf1d2facf02194038a

                                                                                SHA256

                                                                                2586127b11debc62c9847a96110921dc29838c921caa9a61a1a7a155906c45f9

                                                                                SHA512

                                                                                aaae793f1357f84d4a111c80998205d9f21c4860ec062e93b90db34d2463810ee7c8079c43a5dae78d5a00176b03ad4bd05420ea4ccc2a8a7af82fbac6ec72d9

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Roaming\6E9AF\FA95.E9A
                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                c1001b43c61edac08182e1d8e653cdb6

                                                                                SHA1

                                                                                c94db27b999d4e139acb97dd550342d0891711d1

                                                                                SHA256

                                                                                9a2ce8579949d0f471cf67a24912cdbe1f47f60299f3333fbf6a4faf01eb7d57

                                                                                SHA512

                                                                                e56fb3396b7f13f05a1b7592d38ec43ed994a5cc8a7d530bb0f006efe7cd10b32a3e00525d31bdd276a88d03db5743d0494bfcfe2a36cc194b734ba35d6800be

                                                                                Download Submit

                                                                              • memory/720-625-0x000002048CD40000-0x000002048CD60000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/720-657-0x000002048D100000-0x000002048D120000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/720-635-0x000002048CD00000-0x000002048CD20000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/720-620-0x000001FC8AC00000-0x000001FC8AD00000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                                Download

                                                                              • memory/720-621-0x000001FC8AC00000-0x000001FC8AD00000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                                Download

                                                                              • memory/1188-773-0x0000013277960000-0x0000013277980000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/1188-769-0x0000013276800000-0x0000013276900000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                                Download

                                                                              • memory/1188-804-0x0000013277920000-0x0000013277940000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/1188-805-0x0000013277D30000-0x0000013277D50000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/1628-17-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                Filesize

                                                                                424KB

                                                                                Download

                                                                              • memory/1628-16-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                Filesize

                                                                                424KB

                                                                                Download

                                                                              • memory/1700-112-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                Filesize

                                                                                424KB

                                                                                Download

                                                                              • memory/2492-1369-0x0000026C0A1C0000-0x0000026C0A1E0000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/2492-1366-0x0000026C09100000-0x0000026C09200000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                                Download

                                                                              • memory/2492-1384-0x0000026C0A180000-0x0000026C0A1A0000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/2492-1364-0x0000026C09100000-0x0000026C09200000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                                Download

                                                                              • memory/2492-1365-0x0000026C09100000-0x0000026C09200000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                                Download

                                                                              • memory/2624-1227-0x00000265E7750000-0x00000265E7770000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/2624-1211-0x00000265E6430000-0x00000265E6530000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                                Download

                                                                              • memory/2624-1212-0x00000265E6430000-0x00000265E6530000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                                Download

                                                                              • memory/2624-1248-0x00000265E7B60000-0x00000265E7B80000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/2624-1216-0x00000265E7790000-0x00000265E77B0000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/3336-947-0x0000026FCAE70000-0x0000026FCAE90000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/3336-925-0x0000026FCAA60000-0x0000026FCAA80000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/3336-915-0x0000026FCAAA0000-0x0000026FCAAC0000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/3336-910-0x00000267C8940000-0x00000267C8A40000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                                Download

                                                                              • memory/3336-911-0x00000267C8940000-0x00000267C8A40000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                                Download

                                                                              • memory/3496-298-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3624-1209-0x0000000004B00000-0x0000000004B01000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3792-15-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                Filesize

                                                                                416KB

                                                                                Download

                                                                              • memory/3792-13-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                Filesize

                                                                                424KB

                                                                                Download

                                                                              • memory/3792-3-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                Filesize

                                                                                424KB

                                                                                Download

                                                                              • memory/3792-2-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                Filesize

                                                                                416KB

                                                                                Download

                                                                              • memory/3792-735-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                Filesize

                                                                                424KB

                                                                                Download

                                                                              • memory/3792-110-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                Filesize

                                                                                424KB

                                                                                Download

                                                                              • memory/3792-0-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                Filesize

                                                                                424KB

                                                                                Download

                                                                              • memory/3824-454-0x0000000004740000-0x0000000004741000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4084-734-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                Filesize

                                                                                108KB

                                                                                Download

                                                                              • memory/4108-1061-0x0000022150220000-0x0000022150320000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                                Download

                                                                              • memory/4108-1059-0x0000022150220000-0x0000022150320000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                                Download

                                                                              • memory/4108-1078-0x0000022151340000-0x0000022151360000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/4108-1091-0x0000022151750000-0x0000022151770000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/4108-1064-0x0000022151380000-0x00000221513A0000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/4108-1060-0x0000022150220000-0x0000022150320000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                                Download

                                                                              • memory/4300-1057-0x00000000049D0000-0x00000000049D1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4308-908-0x0000000004210000-0x0000000004211000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4428-300-0x000002859D100000-0x000002859D200000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                                Download

                                                                              • memory/4428-301-0x000002859D100000-0x000002859D200000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                                Download

                                                                              • memory/4428-317-0x000002859E1A0000-0x000002859E1C0000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/4428-330-0x000002859E5B0000-0x000002859E5D0000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/4428-305-0x000002859E1E0000-0x000002859E200000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/4484-766-0x00000000042A0000-0x00000000042A1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4536-462-0x000001B439D90000-0x000001B439DB0000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/4536-472-0x000001B439D50000-0x000001B439D70000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/4536-484-0x000001B43A160000-0x000001B43A180000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/4556-1362-0x00000000047F0000-0x00000000047F1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/5076-618-0x00000000033A0000-0x00000000033A1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download