Overview

overview

10

Static

static

3

e1d7873ab3...18.exe

windows7-x64

10

e1d7873ab3...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    76s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-09-2024 06:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e1d7873ab3fff9757a7d1adbfac4d78a_JaffaCakes118.exe

  • Size

    496KB

  • MD5

    e1d7873ab3fff9757a7d1adbfac4d78a

  • SHA1

    51b978be794f710135d6e906afb9c99b7bd3cae4

  • SHA256

    548c45c4643655b42173053632f84bd8c6021db75e0ea89532e1830404779a31

  • SHA512

    b1723b17fedf20783bd651d689e06dbc20a2f457f684c6be1ae16f7bc014fcb4a241294c32ffe2d595544c0176c220e6a56ef23c301b6b4a123d38974c07d53c

  • SSDEEP

    12288:YDCPENnBV5jaHBoFvZstQW012B04Ngjw5qu8jxTQlDrLOM:YEEZBV5jCoFvZsSWG2BdN+w2+O

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 46 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 20 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\e1d7873ab3fff9757a7d1adbfac4d78a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e1d7873ab3fff9757a7d1adbfac4d78a_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Users\Admin\j29oAE.exe
      C:\Users\Admin\j29oAE.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1300
      • C:\Users\Admin\wiulaz.exe
        "C:\Users\Admin\wiulaz.exe"
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3324
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del j29oAE.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:312
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2292
    • C:\Users\Admin\2men.exe
      C:\Users\Admin\2men.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1304
      • C:\Users\Admin\2men.exe
        "C:\Users\Admin\2men.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2024
      • C:\Users\Admin\2men.exe
        "C:\Users\Admin\2men.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:3716
      • C:\Users\Admin\2men.exe
        "C:\Users\Admin\2men.exe"
        3⤵
        • Executes dropped EXE
        • Maps connected drives based on registry
        • Suspicious behavior: EnumeratesProcesses
        PID:752
      • C:\Users\Admin\2men.exe
        "C:\Users\Admin\2men.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1412
      • C:\Users\Admin\2men.exe
        "C:\Users\Admin\2men.exe"
        3⤵
        • Executes dropped EXE
        PID:1644
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 72
          4⤵
          • Program crash
          PID:3960
    • C:\Users\Admin\3men.exe
      C:\Users\Admin\3men.exe
      2⤵
      • Modifies security service
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3628
      • C:\Users\Admin\3men.exe
        C:\Users\Admin\3men.exe startC:\Users\Admin\AppData\Roaming\E0747\07388.exe%C:\Users\Admin\AppData\Roaming\E0747
        3⤵
        • Executes dropped EXE
        PID:4056
      • C:\Users\Admin\3men.exe
        C:\Users\Admin\3men.exe startC:\Program Files (x86)\47B23\lvvm.exe%C:\Program Files (x86)\47B23
        3⤵
        • Executes dropped EXE
        PID:4884
      • C:\Program Files (x86)\LP\88AE\211F.tmp
        "C:\Program Files (x86)\LP\88AE\211F.tmp"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:960
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del e1d7873ab3fff9757a7d1adbfac4d78a_JaffaCakes118.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5064
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3612
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1644 -ip 1644
    1⤵
      PID:4568
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3088
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2324
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4832
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3468
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:640
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:900
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:2036
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4268
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4540
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:4952
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1016
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3608
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4236
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3788
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1912
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3944
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3452
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3128
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4328
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3788
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4308
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:740
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3912
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4376
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:1400
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4228
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4144
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4416
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:620
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2544
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:5116
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:2560
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:2216
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:1948
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:4488
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:3996
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:3988
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:1188
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:4228
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:4332
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:4296
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:1696
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:3424
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:4260
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:3568
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:3468
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:2604
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:4292
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:1372
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:3704
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:2676
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:3752
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:4288
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:3128
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:2092
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:2144
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:3864
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3504
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:3424
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:3656
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:3780
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:2132
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:3476
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:2896
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:180
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:4904
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:4040
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:1384
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:4220
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:1508
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:2856
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                        1⤵
                                                                                          PID:3396

                                                                                        Network

                                                                                        MITRE ATT&CK Enterprise v15

                                                                                        Reconnaissance

                                                                                        Resource Development

                                                                                        Initial Access

                                                                                        Execution

                                                                                        Persistence

                                                                                        Boot or Logon Autostart Execution

                                                                                        2
                                                                                        T1547

                                                                                        Active Setup

                                                                                        1
                                                                                        T1547.014

                                                                                        Registry Run Keys / Startup Folder

                                                                                        1
                                                                                        T1547.001

                                                                                        Create or Modify System Process

                                                                                        1
                                                                                        T1543

                                                                                        Windows Service

                                                                                        1
                                                                                        T1543.003

                                                                                        Privilege Escalation

                                                                                        Boot or Logon Autostart Execution

                                                                                        2
                                                                                        T1547

                                                                                        Active Setup

                                                                                        1
                                                                                        T1547.014

                                                                                        Registry Run Keys / Startup Folder

                                                                                        1
                                                                                        T1547.001

                                                                                        Create or Modify System Process

                                                                                        1
                                                                                        T1543

                                                                                        Windows Service

                                                                                        1
                                                                                        T1543.003

                                                                                        Defense Evasion

                                                                                        Hide Artifacts

                                                                                        1
                                                                                        T1564

                                                                                        Hidden Files and Directories

                                                                                        1
                                                                                        T1564.001

                                                                                        Modify Registry

                                                                                        6
                                                                                        T1112

                                                                                        Credential Access

                                                                                        Credentials from Password Stores

                                                                                        1
                                                                                        T1555

                                                                                        Credentials from Web Browsers

                                                                                        1
                                                                                        T1555.003

                                                                                        Unsecured Credentials

                                                                                        3
                                                                                        T1552

                                                                                        Credentials In Files

                                                                                        3
                                                                                        T1552.001

                                                                                        Discovery

                                                                                        Peripheral Device Discovery

                                                                                        3
                                                                                        T1120

                                                                                        Process Discovery

                                                                                        1
                                                                                        T1057

                                                                                        Query Registry

                                                                                        6
                                                                                        T1012

                                                                                        System Information Discovery

                                                                                        5
                                                                                        T1082

                                                                                        System Location Discovery

                                                                                        1
                                                                                        T1614

                                                                                        System Language Discovery

                                                                                        1
                                                                                        T1614.001

                                                                                        Lateral Movement

                                                                                        Collection

                                                                                        Data from Local System

                                                                                        2
                                                                                        T1005

                                                                                        Command and Control

                                                                                        Exfiltration

                                                                                        Impact

                                                                                        Replay Monitor

                                                                                        Loading Replay Monitor...

                                                                                        Downloads

                                                                                        • C:\Program Files (x86)\LP\88AE\211F.tmp
                                                                                          Filesize

                                                                                          96KB

                                                                                          MD5

                                                                                          6b9ed8570a1857126c8bf99e0663926c

                                                                                          SHA1

                                                                                          94e08d8a0be09be35f37a9b17ec2130febfa2074

                                                                                          SHA256

                                                                                          888e4e571a6f78ee81d94ab56bd033d413f9160f1089073176b03c91878aae2d

                                                                                          SHA512

                                                                                          23211a1b71f1d05ad7f003231da826220ac4940e48071135cc3fba14708123fa0292e2e71c294a8086d8dc5f90dd32c4da3b41e6857c56f38cb325d78cb14880

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\2men.exe
                                                                                          Filesize

                                                                                          132KB

                                                                                          MD5

                                                                                          945a713b037b50442ec5d18d3dc0d55e

                                                                                          SHA1

                                                                                          2c8881b327a79fafcce27479b78f05487d93c802

                                                                                          SHA256

                                                                                          2da470571a64bcdeb56f62c916ee2bffa87ccc6c028b7c8cb0132d09bceedd2f

                                                                                          SHA512

                                                                                          0eab4bb5d04725cc20e463ae6959f71064674602f8ee7b3c9b2db75e928b9a0b1bdc94233dc261f6277d02e54a443b42a59b12aaebb8bbf243f0940344fbf385

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\3men.exe
                                                                                          Filesize

                                                                                          271KB

                                                                                          MD5

                                                                                          0d668203e24463de2bf228f00443b7bc

                                                                                          SHA1

                                                                                          eacff981d71f6648f6315e508bfd75e11683dba8

                                                                                          SHA256

                                                                                          509d530e99839d7dbc8fccac163420d9dc455fb478fa57fdec1b7a2ef629d7bc

                                                                                          SHA512

                                                                                          3251bb1341bd466e71468d72723bd5cf545dbd232327f343b44c51daae8755ed3caa02f74adbb0304912769346fa90dfa4c7036c211836e5650bdb06993ba803

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                          Filesize

                                                                                          471B

                                                                                          MD5

                                                                                          5b9abf66452eeea1d7c44fb81e6c7047

                                                                                          SHA1

                                                                                          a3eda0a768aea6e3a021e988ac5cf9c15e11072d

                                                                                          SHA256

                                                                                          285dc0e6a72e0d4f76f67008be3bd353cbd27504af8e4d764b14210b8b2d0f75

                                                                                          SHA512

                                                                                          e79df652950bb3a859d8aae8a05af9f70e510633e48e65f89948af06b1b34daa51973909483e09c54d0f4484d8146922950e9ac1e33c06225959fd86068d4e26

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                          Filesize

                                                                                          420B

                                                                                          MD5

                                                                                          bd42b82cea452f93bb495954fb2fa990

                                                                                          SHA1

                                                                                          09604b262cb07cfdb7069955a1ac2daf44d90c2d

                                                                                          SHA256

                                                                                          abdafd7b25d1c0e3072f74bf6478a5015660aa737e23338a6313f527be6025e2

                                                                                          SHA512

                                                                                          9a4d158e6f587b2b056435ba8325a65baf75cfed0dc9cf7ae6b001889ee7f69dff9157042e68cdc8bcbf8ad029b6db1b859de3c8e3ae43c87cabfe6acecc7e5f

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                          Filesize

                                                                                          2KB

                                                                                          MD5

                                                                                          535ab6a86f91224e1650f96e710866c5

                                                                                          SHA1

                                                                                          10931632bd770e67ebdde97a188533308d220070

                                                                                          SHA256

                                                                                          82fe1f552f50014e802616cbc9b39b365b04e621247878a3fea139ccdd74d3ed

                                                                                          SHA512

                                                                                          2b200fe0a1d8bddd811802bda63d75959570ae1634a8c8a07d4fb6ed0f0bd52401457768390e31cb6d170203378c16413aa1e2b30e074e0bd42df13d3bea0834

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4ZLXTYAF\microsoft.windows[1].xml
                                                                                          Filesize

                                                                                          97B

                                                                                          MD5

                                                                                          561d428fca25aaeff220ca801100323c

                                                                                          SHA1

                                                                                          703808c3abb1172a6a05ea8a7bdc297eed3d01e6

                                                                                          SHA256

                                                                                          1fd2a6b24b2e481e24953b38587394eab230127867ca14b0f9ac3e365561a83c

                                                                                          SHA512

                                                                                          72f5711ee30b7d41a4bac8bb59ec4c9d488de5a138079ec897a407917b0c4199985077045cbf345654a06352310881c9baef5eaaeb75fb774faad5ee938e1d00

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\E0747\7B23.074
                                                                                          Filesize

                                                                                          600B

                                                                                          MD5

                                                                                          289496f03cc53bcd3088c5acac5eeb1f

                                                                                          SHA1

                                                                                          874caeb561bd878c9ae5da97d363a11af4d4dfef

                                                                                          SHA256

                                                                                          66dd0b501c383a49434a75bd79eae99e1e29554ec5f1f21779c831e236d94533

                                                                                          SHA512

                                                                                          b58a3f6194c15383f5bca89058975522044ae18a819ca85eb42e2abb23d54bdecaff39c1f30bd6f2bf5c4aa9a4f4498cda4b5e8096769ba35b2c82d66e3e3e45

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\E0747\7B23.074
                                                                                          Filesize

                                                                                          996B

                                                                                          MD5

                                                                                          e8771a6cc3e71e2508ce82b2b6721785

                                                                                          SHA1

                                                                                          0521bb51e1ab7e026a3f3f14725c88f213b618bf

                                                                                          SHA256

                                                                                          30f1cbd46f938de3b1e873acec7df0eb0732f0f85b7b3ae8d052a0459f7c7849

                                                                                          SHA512

                                                                                          6a91e4b23faf5cf8e7a5031e3c812aa839b2c57a024cafbdbedf2261d91f0ec706f87132816139497851400b407683456e2107953ecb41468b83309afbafc070

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\E0747\7B23.074
                                                                                          Filesize

                                                                                          1KB

                                                                                          MD5

                                                                                          a443aff9b0931bd98db8632432a4bb5f

                                                                                          SHA1

                                                                                          14f7695e853ecb977cda9f612509a0b860472fcb

                                                                                          SHA256

                                                                                          4de12a966e8b4252585b749aac20380730dd7ca76261b03c07ab42d16e9b68bb

                                                                                          SHA512

                                                                                          a07131bd0a804e19d7993611572f946f7986c81416b631d06fbba3c65928e048b29f650c60341f1bd69cb625a82bb5ebcc83368a7cc95a3859606df491822091

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\E0747\7B23.074
                                                                                          Filesize

                                                                                          1KB

                                                                                          MD5

                                                                                          1bbdbf7e96ef14d47eaf851b94dcc8c7

                                                                                          SHA1

                                                                                          a255ffe86ba4a6a198d31da29a8c0e640c02436c

                                                                                          SHA256

                                                                                          1b7ed71f5de067f7c8995052200121d4f09d56dbb5f8ea9b848c75ec498932fa

                                                                                          SHA512

                                                                                          444d851effcdfd9d269dbd9268cfadba6e27b8614f449f16012c18749fe3a5c321183eae5df30cb0596f0edba525541ae8ccf3b072a830be379edbf2b331cbf6

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\j29oAE.exe
                                                                                          Filesize

                                                                                          176KB

                                                                                          MD5

                                                                                          c4a634088e095eab98183984bb7252d8

                                                                                          SHA1

                                                                                          c205f2c1f8040c9205c6c06accd75c0396c59781

                                                                                          SHA256

                                                                                          db345985313397a39cc2817134315c8db71ab4c48680e62c0358db406b0eff6a

                                                                                          SHA512

                                                                                          b6a30f6d5cc30bee9b9d483629f16c80c5338360cec629f9ee2a3307b73b9743fd71396e408ac72008b84f4b8fded26002c910421853253b52b8b4d530df7a8e

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\wiulaz.exe
                                                                                          Filesize

                                                                                          176KB

                                                                                          MD5

                                                                                          37ee5b1f1bba036d506c03d9dcf534f7

                                                                                          SHA1

                                                                                          06a831ff20bff0af5ff373eff2b95cc68b06071a

                                                                                          SHA256

                                                                                          fbf19059b5750d4b5a4d71e92f727b91259a075743b5a78d8709756dadb18e09

                                                                                          SHA512

                                                                                          f50489109fc8a7dc39c6da4fae6bb854ccd6160395c40b2c6b23cc74be9a47da38e955bd77c00a9051443918199254dd6ed58b2b24f298cb0df3c46b9cb5af5a

                                                                                          Download Submit

                                                                                        • memory/752-64-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                          Filesize

                                                                                          152KB

                                                                                          Download

                                                                                        • memory/752-62-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                          Filesize

                                                                                          152KB

                                                                                          Download

                                                                                        • memory/752-60-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                          Filesize

                                                                                          152KB

                                                                                          Download

                                                                                        • memory/752-63-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                          Filesize

                                                                                          152KB

                                                                                          Download

                                                                                        • memory/752-92-0x0000000000400000-0x0000000000426000-memory.dmp

                                                                                          Filesize

                                                                                          152KB

                                                                                          Download

                                                                                        • memory/900-428-0x000001D22ADC0000-0x000001D22ADE0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/900-407-0x000001D22B100000-0x000001D22B120000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/900-403-0x000001D22A200000-0x000001D22A300000-memory.dmp

                                                                                          Filesize

                                                                                          1024KB

                                                                                          Download

                                                                                        • memory/900-441-0x000001D22B6E0000-0x000001D22B700000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/960-839-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                          Filesize

                                                                                          112KB

                                                                                          Download

                                                                                        • memory/1412-69-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                          Filesize

                                                                                          28KB

                                                                                          Download

                                                                                        • memory/1412-67-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                          Filesize

                                                                                          28KB

                                                                                          Download

                                                                                        • memory/1412-65-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                          Filesize

                                                                                          28KB

                                                                                          Download

                                                                                        • memory/1412-95-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                          Filesize

                                                                                          28KB

                                                                                          Download

                                                                                        • memory/2024-49-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                          Filesize

                                                                                          28KB

                                                                                          Download

                                                                                        • memory/2024-47-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                          Filesize

                                                                                          28KB

                                                                                          Download

                                                                                        • memory/2024-77-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                          Filesize

                                                                                          28KB

                                                                                          Download

                                                                                        • memory/2024-51-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                          Filesize

                                                                                          28KB

                                                                                          Download

                                                                                        • memory/2036-559-0x0000000004D20000-0x0000000004D21000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/3468-400-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/3608-724-0x000001D979400000-0x000001D979500000-memory.dmp

                                                                                          Filesize

                                                                                          1024KB

                                                                                          Download

                                                                                        • memory/3608-741-0x000001D97A500000-0x000001D97A520000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/3608-761-0x000001D97A900000-0x000001D97A920000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/3608-729-0x000001D97A540000-0x000001D97A560000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/3628-214-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                          Filesize

                                                                                          424KB

                                                                                          Download

                                                                                        • memory/3628-97-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                          Filesize

                                                                                          424KB

                                                                                          Download

                                                                                        • memory/3628-840-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                          Filesize

                                                                                          424KB

                                                                                          Download

                                                                                        • memory/3716-58-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                          Filesize

                                                                                          56KB

                                                                                          Download

                                                                                        • memory/3716-54-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                          Filesize

                                                                                          56KB

                                                                                          Download

                                                                                        • memory/3716-52-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                          Filesize

                                                                                          56KB

                                                                                          Download

                                                                                        • memory/3716-55-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                          Filesize

                                                                                          56KB

                                                                                          Download

                                                                                        • memory/4056-99-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                          Filesize

                                                                                          424KB

                                                                                          Download

                                                                                        • memory/4540-596-0x0000023FCDE20000-0x0000023FCDE40000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/4540-601-0x0000023FCE1B0000-0x0000023FCE1D0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/4540-566-0x0000023FCDE60000-0x0000023FCDE80000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/4540-561-0x0000023FCCB00000-0x0000023FCCC00000-memory.dmp

                                                                                          Filesize

                                                                                          1024KB

                                                                                          Download

                                                                                        • memory/4884-216-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                          Filesize

                                                                                          424KB

                                                                                          Download

                                                                                        • memory/4952-719-0x0000000004850000-0x0000000004851000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download