Overview

overview

10

Static

static

3

df7004566b...18.exe

windows7-x64

10

df7004566b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    89s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-09-2024 03:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe

  • Size

    278KB

  • MD5

    df7004566bd1250ad7912571bbeb3d47

  • SHA1

    7ecda9cdd006e84f48b0c6e9890a882127878d0d

  • SHA256

    e441a984525d5fd2cd17bcb90bc4a9bd77469acee48fe800802e60c2c1529a28

  • SHA512

    9478a75444bba9e35c58027c191fe75d242e968b5d9c4ee851d6bda075b73ed22f297c291726bac9c2682c8c4f92fcea134f378296a41ab5446065d81bad45ab

  • SSDEEP

    6144:/bYJKT03oCUI8y+tTVB9pDtF4/hWYq8KG1t4qeiiw:/XoUI8PVLpDtGwYMxi/

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 15 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 28 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 26 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3780
    • C:\Users\Admin\AppData\Local\Temp\df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\62531\5A098.exe%C:\Users\Admin\AppData\Roaming\62531
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4808
    • C:\Users\Admin\AppData\Local\Temp\df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\df7004566bd1250ad7912571bbeb3d47_JaffaCakes118.exe startC:\Program Files (x86)\31012\lvvm.exe%C:\Program Files (x86)\31012
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4952
    • C:\Program Files (x86)\LP\9876\F627.tmp
      "C:\Program Files (x86)\LP\9876\F627.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1584
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3108
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:640
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1872
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1400
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2136
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2104
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4676
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2196
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:3084
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:380
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3692
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3268
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3448
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2016
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:508
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:320
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:688
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4780
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3268
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1684
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3244
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4220
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4004
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4404
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3556
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4540
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:3964
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1388
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3028
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2072
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1428
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4572
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4112
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4212
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2500
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1816
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2904
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3328
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4000
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4552
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4252
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:3328
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:3772
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:3620
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:4448
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:3340
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:4264
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4876
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:1588
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:4012
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:4304
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:4844
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:4960
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:4012
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:2276
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:876
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:2132
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:4160
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:4684
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:4076
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:4364
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:4044
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:4108
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:3824
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:3540
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4232
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:1224
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:4824
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:1920
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:1984
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:1684
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:3000
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:4908
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:4928
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:212
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:2152
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:2352

                                                                        Network

                                                                        MITRE ATT&CK Enterprise v15

                                                                        Reconnaissance

                                                                        Resource Development

                                                                        Initial Access

                                                                        Execution

                                                                        Persistence

                                                                        Boot or Logon Autostart Execution

                                                                        2
                                                                        T1547

                                                                        Active Setup

                                                                        1
                                                                        T1547.014

                                                                        Registry Run Keys / Startup Folder

                                                                        1
                                                                        T1547.001

                                                                        Create or Modify System Process

                                                                        1
                                                                        T1543

                                                                        Windows Service

                                                                        1
                                                                        T1543.003

                                                                        Privilege Escalation

                                                                        Boot or Logon Autostart Execution

                                                                        2
                                                                        T1547

                                                                        Active Setup

                                                                        1
                                                                        T1547.014

                                                                        Registry Run Keys / Startup Folder

                                                                        1
                                                                        T1547.001

                                                                        Create or Modify System Process

                                                                        1
                                                                        T1543

                                                                        Windows Service

                                                                        1
                                                                        T1543.003

                                                                        Defense Evasion

                                                                        Modify Registry

                                                                        5
                                                                        T1112

                                                                        Credential Access

                                                                        Credentials from Password Stores

                                                                        1
                                                                        T1555

                                                                        Credentials from Web Browsers

                                                                        1
                                                                        T1555.003

                                                                        Unsecured Credentials

                                                                        3
                                                                        T1552

                                                                        Credentials In Files

                                                                        3
                                                                        T1552.001

                                                                        Discovery

                                                                        Peripheral Device Discovery

                                                                        2
                                                                        T1120

                                                                        Query Registry

                                                                        4
                                                                        T1012

                                                                        System Information Discovery

                                                                        2
                                                                        T1082

                                                                        System Location Discovery

                                                                        1
                                                                        T1614

                                                                        System Language Discovery

                                                                        1
                                                                        T1614.001

                                                                        Lateral Movement

                                                                        Collection

                                                                        Data from Local System

                                                                        2
                                                                        T1005

                                                                        Command and Control

                                                                        Exfiltration

                                                                        Impact

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\Program Files (x86)\LP\9876\F627.tmp
                                                                          Filesize

                                                                          99KB

                                                                          MD5

                                                                          b6c44c70136fcbed1aace964c4e98e9d

                                                                          SHA1

                                                                          4f7961087e09cdf03efe4fe0b7f2243499504628

                                                                          SHA256

                                                                          75d10ab1bea3e7cb80e3c0048b79cf0496c88b885ff853d6f430c71272030bcd

                                                                          SHA512

                                                                          801762bbc8ffa62fd49dadb75bfa0ff31f73ee4b712c91d23885f0d4fbc45eebbc30f2ab84e04ce375e8a269bb2a1c8514c4dd9cbd50f42e5960987c719092da

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                          Filesize

                                                                          471B

                                                                          MD5

                                                                          ddab9ba6d995c9cccd95964b4ad4ce40

                                                                          SHA1

                                                                          5345a6d122113475b8a2b36b3273efe1ea48f4e8

                                                                          SHA256

                                                                          f492031400502c7376269631d12a43ee11b3908b03a1bb0da7882bf23b0a7e9b

                                                                          SHA512

                                                                          ed56b541c9bab8cfbbef667351774a27133d47f3269c193f77bdc0b3108c7d4c090657a9e9c1bfe446d58badb6c56b99565784f4db3e04b85cdd7993a8a0dde4

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                          Filesize

                                                                          420B

                                                                          MD5

                                                                          a0283024e0ef2a056f974f3f571abf5b

                                                                          SHA1

                                                                          34dc3bedf9877890991c431a6961b8da4b38155c

                                                                          SHA256

                                                                          45877d55cf82857629b07606dc28044e08c5adbd088a55c4597689d9833ae4f9

                                                                          SHA512

                                                                          7eaf455353f3a7a2c32e1fe5ca7301dfbdc4a0ce49df55927e0f5f679626be9699a5a9cfb85f96a9ea5ef159e6683ea78ff5fa19f88ddcca94c4bbbb9ede4f89

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                          Filesize

                                                                          2KB

                                                                          MD5

                                                                          b00cc90f8dc01aa5885b6900f00d95c0

                                                                          SHA1

                                                                          7a082c72c754dc9f5c52dd0986ddcd6ee9c31fd3

                                                                          SHA256

                                                                          ed1b617ce18d1cc19e2bf9c6a6170f64454742d2fd7e913facb907c42d7c92cd

                                                                          SHA512

                                                                          6ddb63fae36e73176932fc2a67e0288ca04ba5a63ea7bff82e8b7f0d5908387104a7255a6c989412147097367b85c1f42f03647f5b2ebf616e029fc9dc6a76f8

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
                                                                          Filesize

                                                                          36KB

                                                                          MD5

                                                                          0e2a09c8b94747fa78ec836b5711c0c0

                                                                          SHA1

                                                                          92495421ad887f27f53784c470884802797025ad

                                                                          SHA256

                                                                          0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                          SHA512

                                                                          61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
                                                                          Filesize

                                                                          36KB

                                                                          MD5

                                                                          ab0262f72142aab53d5402e6d0cb5d24

                                                                          SHA1

                                                                          eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                          SHA256

                                                                          20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                          SHA512

                                                                          bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\RMU4N5WP\microsoft.windows[1].xml
                                                                          Filesize

                                                                          97B

                                                                          MD5

                                                                          1e30d8c8ef07e3c98200641a90d1ae95

                                                                          SHA1

                                                                          b8e86446e5ff4d10984af769b912d8d34313da54

                                                                          SHA256

                                                                          0d0b29673b1fcaea71df3130c5c5cf31a8f8bbd16b60f9861b4a42665c934493

                                                                          SHA512

                                                                          bc0ca2e71bcc7f3680c683f91a87204d614f4bac56750619f449194f6aa69d983f526b4f73a5fed083ad56d648dfcce3a80c25b93fd07e76b616f14b219b6f04

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\62531\1012.253
                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          760f57412be9fd6106d9af50e190b51e

                                                                          SHA1

                                                                          40b2bc39ddfd52aeccfbaa6ec34f25e80dd70d37

                                                                          SHA256

                                                                          bdc5f808310f4486c4a1d9d7c775858b8c10e5f5c2fb1c97a19926c28ce0dab4

                                                                          SHA512

                                                                          2186e6287149d23df33da5c9ec4c60904df18bf48d5f59ffb94efa019e8446255c7d8a4853ff59f5ac45ec814e4966613b731672df2d0c739669ab0deae93e21

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\62531\1012.253
                                                                          Filesize

                                                                          600B

                                                                          MD5

                                                                          7fff9a1927af5d3a632139db78080ac2

                                                                          SHA1

                                                                          378e07a313ee0e11836e29135df0299635c5eebf

                                                                          SHA256

                                                                          d569f8dc87d2281d10ee9680996572ebe5a494c8ca9aac995f2b509aabb97005

                                                                          SHA512

                                                                          a6da3ee37bb572481491e3d5797c90a43d75cfefd65a141bce588f9e4b1da95ef5ad8e8c7900461bf220a3ff3a9ecefc49b66f1274a917aa73a5c6aad3cf5aa1

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\62531\1012.253
                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          555b0b8d8a298fa222001e87fbec3fea

                                                                          SHA1

                                                                          90e8351e5263eed58c702aa0973a95aaabc92922

                                                                          SHA256

                                                                          e4db35f016885a9e8e4b9412879f4b58162a8f41b09b2c2fd507dfb7284f11b8

                                                                          SHA512

                                                                          3f13bc34aab85d1da3567753ee360bcdbbcd2d097b4016ff6c6fc37144602e7028357cb0240c0b3df82deaee360d3a45e49c64306a93e9b38ec92b0ac42925c3

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\62531\1012.253
                                                                          Filesize

                                                                          996B

                                                                          MD5

                                                                          0c7f182fad1fd7b8080e77b79b81b26c

                                                                          SHA1

                                                                          fc657aae2993e558097de93d94e5a8e5b5e9ba17

                                                                          SHA256

                                                                          dd03d434bebfa64b3c1c4e03abe1b3127bd0ec39ce37dcd2bed5ec67c700d173

                                                                          SHA512

                                                                          7acc06538ac05ae4ec6c256d8b14b6641853cee926d69ba8d274a8188d77c7e781992380002fd6e4a92c19d954a3fe74a8775fb596d5bcc28dcb18182e2582c2

                                                                          Download Submit

                                                                        • memory/508-643-0x00000000049F0000-0x00000000049F1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/688-672-0x0000017A78B30000-0x0000017A78B50000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/688-645-0x0000017276600000-0x0000017276700000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/688-646-0x0000017276600000-0x0000017276700000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/688-650-0x0000017A78760000-0x0000017A78780000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/688-659-0x0000017A78720000-0x0000017A78740000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/1584-488-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                          Filesize

                                                                          112KB

                                                                          Download

                                                                        • memory/1684-795-0x0000020909E20000-0x0000020909F20000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/1684-794-0x0000020909E20000-0x0000020909F20000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/1684-822-0x000002110C550000-0x000002110C570000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/1684-793-0x0000020909E20000-0x0000020909F20000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/1684-798-0x000002110C180000-0x000002110C1A0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/1684-811-0x000002110C140000-0x000002110C160000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/2016-530-0x000001C7F5CA0000-0x000001C7F5CC0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/2016-511-0x000001C7F5690000-0x000001C7F56B0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/2016-498-0x000001C7F56D0000-0x000001C7F56F0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/2016-493-0x000001C7F4770000-0x000001C7F4870000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/2016-494-0x000001C7F4770000-0x000001C7F4870000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/2072-1370-0x00000000044E0000-0x00000000044E1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/2104-178-0x0000000003250000-0x0000000003251000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/2196-210-0x0000028FAAB90000-0x0000028FAABB0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/2196-179-0x0000028FA9700000-0x0000028FA9800000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/2196-180-0x0000028FA9700000-0x0000028FA9800000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/2196-196-0x0000028FAA780000-0x0000028FAA7A0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/2196-184-0x0000028FAA7C0000-0x0000028FAA7E0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/3028-1226-0x00000244F4500000-0x00000244F4520000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/3028-1247-0x00000244F41C0000-0x00000244F41E0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/3028-1257-0x00000244F48D0000-0x00000244F48F0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/3084-338-0x0000000004880000-0x0000000004881000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/3244-932-0x0000000004540000-0x0000000004541000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/3268-491-0x0000000004980000-0x0000000004981000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/3692-342-0x0000019E85700000-0x0000019E85800000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/3692-340-0x0000019E85700000-0x0000019E85800000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/3692-356-0x0000019E86A20000-0x0000019E86A40000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/3692-345-0x0000019E86A60000-0x0000019E86A80000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/3692-367-0x0000019E86E20000-0x0000019E86E40000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/3780-1-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                          Filesize

                                                                          416KB

                                                                          Download

                                                                        • memory/3780-2-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                          Filesize

                                                                          428KB

                                                                          Download

                                                                        • memory/3780-11-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                          Filesize

                                                                          428KB

                                                                          Download

                                                                        • memory/3780-73-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                          Filesize

                                                                          428KB

                                                                          Download

                                                                        • memory/3780-13-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                          Filesize

                                                                          416KB

                                                                          Download

                                                                        • memory/3780-490-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                          Filesize

                                                                          428KB

                                                                          Download

                                                                        • memory/3964-1218-0x00000000045D0000-0x00000000045D1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/4004-933-0x0000019E07F00000-0x0000019E08000000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/4004-951-0x000001A60A320000-0x000001A60A340000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4004-963-0x000001A60A730000-0x000001A60A750000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4004-934-0x0000019E07F00000-0x0000019E08000000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/4004-935-0x0000019E07F00000-0x0000019E08000000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/4004-938-0x000001A60A360000-0x000001A60A380000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4404-1080-0x0000000004280000-0x0000000004281000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/4540-1082-0x0000028257650000-0x0000028257750000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/4540-1097-0x0000028258770000-0x0000028258790000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4540-1111-0x0000028258B80000-0x0000028258BA0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4540-1087-0x00000282587B0000-0x00000282587D0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4540-1083-0x0000028257650000-0x0000028257750000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/4572-1372-0x000001F97ED00000-0x000001F97EE00000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/4780-791-0x0000000002560000-0x0000000002561000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/4808-14-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                          Filesize

                                                                          428KB

                                                                          Download

                                                                        • memory/4808-15-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                          Filesize

                                                                          428KB

                                                                          Download

                                                                        • memory/4808-17-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                          Filesize

                                                                          428KB

                                                                          Download

                                                                        • memory/4952-75-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                          Filesize

                                                                          428KB

                                                                          Download