Overview

overview

10

Static

static

3

fb1b32c15b...18.exe

windows7-x64

10

fb1b32c15b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    69s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-09-2024 23:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fb1b32c15b3ad5034efbe479e210076d_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    fb1b32c15b3ad5034efbe479e210076d

  • SHA1

    04c12f504481c36754277c593e80fcc43be69eb3

  • SHA256

    4c3eb1c67531d16013dd0d55a30403945e5649367b0be7473764aa1998245993

  • SHA512

    9e6cbee35909468698df7bd561b33b845d9b6f13f79bf1b39b07004afad0a5ebd622fc7259befbcb442d046eb431c18ec950b211a471ea64a67ca83ae95df975

  • SSDEEP

    24576:VWPKPd38f8LJDCePQPhSbcxjtxplwW2HOoWK5vnUYlIF/3tUHDFhbQMZ:gvOJDHQPhSgRtxpFBQlolUHDFhbQMZ

Score
10/10
ponycredential_accessdefense_evasiondiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 18 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb1b32c15b3ad5034efbe479e210076d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fb1b32c15b3ad5034efbe479e210076d_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3412
    • C:\Users\Admin\AppData\Local\Temp\nsrA4CD.tmp\Wolfe, Gene - Book of the New Sun 02 - Sword and Citadel.exe
      "C:\Users\Admin\AppData\Local\Temp\nsrA4CD.tmp\Wolfe, Gene - Book of the New Sun 02 - Sword and Citadel.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3516
    • C:\Users\Admin\AppData\Local\Temp\nsrA4CD.tmp\ic5.exe
      "C:\Users\Admin\AppData\Local\Temp\nsrA4CD.tmp\ic5.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Windows\explorer.exe
        000001E0*
        3⤵
          PID:1140
      • C:\Users\Admin\AppData\Local\Temp\nsrA4CD.tmp\2 Gansta.exe
        "C:\Users\Admin\AppData\Local\Temp\nsrA4CD.tmp\2 Gansta.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4000
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\nsrA4CD.tmp\2GANST~1.EXE > nul
          3⤵
          • System Location Discovery: System Language Discovery
          PID:664
      • C:\Users\Admin\AppData\Local\Temp\nsrA4CD.tmp\3R2R.exe
        "C:\Users\Admin\AppData\Local\Temp\nsrA4CD.tmp\3R2R.exe"
        2⤵
        • Modifies security service
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:4192
        • C:\Users\Admin\AppData\Local\Temp\nsrA4CD.tmp\3R2R.exe
          C:\Users\Admin\AppData\Local\Temp\nsrA4CD.tmp\3R2R.exe startC:\Users\Admin\AppData\Roaming\1A229\D2E82.exe%C:\Users\Admin\AppData\Roaming\1A229
          3⤵
          • Executes dropped EXE
          PID:3192
        • C:\Users\Admin\AppData\Local\Temp\nsrA4CD.tmp\3R2R.exe
          C:\Users\Admin\AppData\Local\Temp\nsrA4CD.tmp\3R2R.exe startC:\Program Files (x86)\2936A\lvvm.exe%C:\Program Files (x86)\2936A
          3⤵
          • Executes dropped EXE
          PID:396
        • C:\Program Files (x86)\LP\8281\21EB.tmp
          "C:\Program Files (x86)\LP\8281\21EB.tmp"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2540
      • C:\Users\Admin\AppData\Local\Temp\nsrA4CD.tmp\4tbp.exe
        "C:\Users\Admin\AppData\Local\Temp\nsrA4CD.tmp\4tbp.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5000
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\mprowre.dll",Startup
          3⤵
          • Loads dropped DLL
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1576
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32.exe "C:\Users\Admin\AppData\Local\mprowre.dll",iep
            4⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1808
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4300
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4976
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2800
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1144
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4056
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1840
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4720
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3328
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:1656
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4056
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:812
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3816
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3252
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4760
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4056
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1068
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4528
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4808
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3896
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4876
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3180
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1312
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3712
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Modifies registry class
      PID:2124
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:3540
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:4184
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:2416
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:3420
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:1948
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:3020
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:208
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:5064
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:3128
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:4164
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:1108
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:684
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:4972
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:3000
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:4512
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:5056
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:3564
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:1016
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:3512
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:664
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:3784
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:3668
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:3056
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:2120
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:2952
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:4468
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:2284
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:2376
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:1068
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:4408
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:3740
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:3684
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:3712
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:220
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:2376
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:3640
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:3572
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:1100
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:2956
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:3180
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:3252
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:2928
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:1924
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:4196
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:4552
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:3816
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                  1⤵
                                                                                                    PID:4356

                                                                                                  Network

                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                  Reconnaissance

                                                                                                  Resource Development

                                                                                                  Initial Access

                                                                                                  Execution

                                                                                                  Persistence

                                                                                                  Boot or Logon Autostart Execution

                                                                                                  2
                                                                                                  T1547

                                                                                                  Active Setup

                                                                                                  1
                                                                                                  T1547.014

                                                                                                  Registry Run Keys / Startup Folder

                                                                                                  1
                                                                                                  T1547.001

                                                                                                  Create or Modify System Process

                                                                                                  1
                                                                                                  T1543

                                                                                                  Windows Service

                                                                                                  1
                                                                                                  T1543.003

                                                                                                  Privilege Escalation

                                                                                                  Boot or Logon Autostart Execution

                                                                                                  2
                                                                                                  T1547

                                                                                                  Active Setup

                                                                                                  1
                                                                                                  T1547.014

                                                                                                  Registry Run Keys / Startup Folder

                                                                                                  1
                                                                                                  T1547.001

                                                                                                  Create or Modify System Process

                                                                                                  1
                                                                                                  T1543

                                                                                                  Windows Service

                                                                                                  1
                                                                                                  T1543.003

                                                                                                  Defense Evasion

                                                                                                  Indicator Removal

                                                                                                  1
                                                                                                  T1070

                                                                                                  File Deletion

                                                                                                  1
                                                                                                  T1070.004

                                                                                                  Modify Registry

                                                                                                  5
                                                                                                  T1112

                                                                                                  Credential Access

                                                                                                  Credentials from Password Stores

                                                                                                  1
                                                                                                  T1555

                                                                                                  Credentials from Web Browsers

                                                                                                  1
                                                                                                  T1555.003

                                                                                                  Unsecured Credentials

                                                                                                  3
                                                                                                  T1552

                                                                                                  Credentials In Files

                                                                                                  3
                                                                                                  T1552.001

                                                                                                  Discovery

                                                                                                  Peripheral Device Discovery

                                                                                                  2
                                                                                                  T1120

                                                                                                  Query Registry

                                                                                                  5
                                                                                                  T1012

                                                                                                  System Information Discovery

                                                                                                  4
                                                                                                  T1082

                                                                                                  System Location Discovery

                                                                                                  1
                                                                                                  T1614

                                                                                                  System Language Discovery

                                                                                                  1
                                                                                                  T1614.001

                                                                                                  Lateral Movement

                                                                                                  Collection

                                                                                                  Data from Local System

                                                                                                  2
                                                                                                  T1005

                                                                                                  Command and Control

                                                                                                  Exfiltration

                                                                                                  Impact

                                                                                                  Replay Monitor

                                                                                                  Loading Replay Monitor...

                                                                                                  Downloads

                                                                                                  • C:\Program Files (x86)\LP\8281\21EB.tmp
                                                                                                    Filesize

                                                                                                    100KB

                                                                                                    MD5

                                                                                                    bc4366d0a577f23038c4078b9daa6529

                                                                                                    SHA1

                                                                                                    057b8992c93e8eb027190cddf22b4953b2038418

                                                                                                    SHA256

                                                                                                    a5b375d932be3fa254012d6a15047dbdde68744fb323cada056bf1056a36a627

                                                                                                    SHA512

                                                                                                    e29f546c1d978e3663872c8a532ec8f4c05c06b14554f06f6403cd049d202a9c6cdc73f8955ba0e8215e5ef1dbdbf40f61d6ed6ccdfaa70f8033c18c346ca274

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                    Filesize

                                                                                                    471B

                                                                                                    MD5

                                                                                                    1f02b795d703ffe77e8cf0ac4a209329

                                                                                                    SHA1

                                                                                                    19eaa8c597efd541c94d6e2c5642edacedcc51bc

                                                                                                    SHA256

                                                                                                    48eacb1ee044d692b42f3a6e6a3d0615313e66587ba17b995e2cf894a6c2813d

                                                                                                    SHA512

                                                                                                    6613dabd6027a78628ad6dbe2793455a927e9d60a94c6fbaf11a93e3a991eac711dfcc2039b3e825908a1a1014ef573d3e8d741beda3c10c6a33432501339fe0

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                    Filesize

                                                                                                    420B

                                                                                                    MD5

                                                                                                    bdcaac99225fda5ca5df45d1a0715649

                                                                                                    SHA1

                                                                                                    d83ddaa7ce6e44cc0089e8ac50f4848f9d6e465d

                                                                                                    SHA256

                                                                                                    8514d2e9201b9e31aa1978302c631571e1e1f7c4f4991b7161f09120b7328217

                                                                                                    SHA512

                                                                                                    4293eb75248f649859d3b3f4e2cd1c822e4a163f9889432352a5c09585511aa7d155802049eabdeef66bca17863d1b9e4526f3406d004496b7fc2c46e898d386

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    6c058a47fa30fa25ec30595caaebb99d

                                                                                                    SHA1

                                                                                                    a56d958090b927c3093eff77cf7d8d1aa0204019

                                                                                                    SHA256

                                                                                                    9c1027a3daa3967baa95f7f356d0c1d17a782750653d1122a992a1c96e15539d

                                                                                                    SHA512

                                                                                                    64219e79fc9e1591f5f3f6514f85a46c28d1c377f65741592d877f4e5eaafdd109689c43b29a559849fe63d37da2ff746e596409875cf475262c7c32b7301ef8

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QKJHZK6M\microsoft.windows[1].xml
                                                                                                    Filesize

                                                                                                    96B

                                                                                                    MD5

                                                                                                    c80e07f2e2bce84e8f3380b42ba6bd94

                                                                                                    SHA1

                                                                                                    33e20b05fc67a22ac3f3c214a32057254f97f2e7

                                                                                                    SHA256

                                                                                                    14808d37f1d44780098ddc2af07f7862b3c0c5ab1bfed6b267621e0a332a8bbd

                                                                                                    SHA512

                                                                                                    f5adf8b7bbc1b450249034376f7df69eaf2a7be8e516d511bb82828c19efddbee9247d20e4b4c629b7fe58c9391c31fbf48bdb1b857ca13e5f52b80cb7883f24

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsrA4CD.tmp\2 Gansta.exe
                                                                                                    Filesize

                                                                                                    6KB

                                                                                                    MD5

                                                                                                    bee76c79e2e63e198038e01f0d571038

                                                                                                    SHA1

                                                                                                    fcffdd6bb030f516a46e9d303ebae2ab33af222e

                                                                                                    SHA256

                                                                                                    50a3c7134460bfe5f2840bd8dc957edfaa76da5beaaff70f8da5e0fef80ae876

                                                                                                    SHA512

                                                                                                    dd2e9488ad365c02722e1a2466acffb8beaf4dbb68d7093e01c50cd915418ca0642cb6bdd43f2f2b014455803f3c69dec24ca9dfee11bdf7790379181cd2f6f9

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsrA4CD.tmp\3R2R.exe
                                                                                                    Filesize

                                                                                                    281KB

                                                                                                    MD5

                                                                                                    f25c5ce835570548f56fb76d200e5a85

                                                                                                    SHA1

                                                                                                    4546ff42a0124ddce6fba8c741f243a13ea62070

                                                                                                    SHA256

                                                                                                    c2e7735af27176afe00cf5b13b8340517fd01299691a54427ce5fd7591db9759

                                                                                                    SHA512

                                                                                                    2cc92b646241f3bdcd5d9ffd546574c3d2bf36fff08a54b4dc29284f855c3b47928f7bc40bc174bc3b68d0805fe8a6f4739a17aef07b7e0af4903a19133b59a9

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsrA4CD.tmp\4tbp.exe
                                                                                                    Filesize

                                                                                                    108KB

                                                                                                    MD5

                                                                                                    03b927c7c418bb244c2080e40bc7c20e

                                                                                                    SHA1

                                                                                                    f8abf451378cbc13ec4c336456d0ba096ed64459

                                                                                                    SHA256

                                                                                                    317d95ad3f8b58b6e7d7623e4ead965aea9eff10934280ca3cfa104f3d176f48

                                                                                                    SHA512

                                                                                                    329102dee848ed482c07e3d7cd528088a7526179382d72cf9c5a8325519fe40a5adbb1f8bb560ccd4a8e876f4ca3f0e893f8983195ad775249844dcdf4e39747

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsrA4CD.tmp\Wolfe, Gene - Book of the New Sun 02 - Sword and Citadel.exe
                                                                                                    Filesize

                                                                                                    807KB

                                                                                                    MD5

                                                                                                    161ec2a78b8fd2b740cab4ccc7ebecaf

                                                                                                    SHA1

                                                                                                    5d4ae2d0a90314cdf4952848c5206dbc75b13a10

                                                                                                    SHA256

                                                                                                    8a963016dea52ba8b2190d2ad2f38ea6283dd1394641814e4b9c6ebce32e21d2

                                                                                                    SHA512

                                                                                                    4a1efc7abbf7875faf67f22ae96e75add70ff74f1f0a017cd7b65c404fcbd3dfd3a6ca2546056a7263ea19347bc71f36fcd094fc0bcbd07d6355825259efd30f

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nsrA4CD.tmp\ic5.exe
                                                                                                    Filesize

                                                                                                    150KB

                                                                                                    MD5

                                                                                                    58ab20cd01024368a62cc6501c663a89

                                                                                                    SHA1

                                                                                                    6e156412ab82920aae95bb375a5efc8c82436f54

                                                                                                    SHA256

                                                                                                    cde043a40ee019077541e722b0d120395997c0bf944444966da691b10dfd8937

                                                                                                    SHA512

                                                                                                    9feed6407c64afcbd52c59faccbf9d1f51b6447144f5404c2b6a51c3ee07c99896af04c2a309daa3682adf0bd2ff4be0cce5427f6d7e1e7744bc8cf1fe9be19f

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Local\mprowre.dll
                                                                                                    Filesize

                                                                                                    108KB

                                                                                                    MD5

                                                                                                    7d7679b1493c32da08daae1949e9724c

                                                                                                    SHA1

                                                                                                    32da402420f912e637f2a54c73d54d31c73d4912

                                                                                                    SHA256

                                                                                                    5f73756e6fafd121ddff05750d8c21a4d9a29d319b8022591787451af7766aa5

                                                                                                    SHA512

                                                                                                    6a57805aa0d0df5020b0290d4b0121621a278dc97f31c93dfd64420a597d90212037e7559fe5550d2f68e850714fbfc326a887ec48651e3617725edf5258d15d

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Roaming\1A229\936A.A22
                                                                                                    Filesize

                                                                                                    996B

                                                                                                    MD5

                                                                                                    1d8b2d1509e803f4fab236d68b52f058

                                                                                                    SHA1

                                                                                                    bd0d32cde6a39b090f0356839e24a321227d239b

                                                                                                    SHA256

                                                                                                    3576723764135d18a5f480fee5c21c809a09a7a0ff80ad05daf984870fb6bb48

                                                                                                    SHA512

                                                                                                    2a7dccb86e7e5d05d55e8b9dad314232f52ee1faf642327b2cd3e303ffaf0b907e00dc11cd027d285bef6682c56df561b78650b88ed7ae8a09bc792fd94b320d

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Roaming\1A229\936A.A22
                                                                                                    Filesize

                                                                                                    1KB

                                                                                                    MD5

                                                                                                    5a3726bf9acfd4f8be8479ee9195f403

                                                                                                    SHA1

                                                                                                    0902fbf12a528a7aebfd9ff1f01475c0152f5922

                                                                                                    SHA256

                                                                                                    96960afd1b7b84f68e557cd4f152c906807b8d810bd8c9753eea08d78d8743d5

                                                                                                    SHA512

                                                                                                    dc75a39af300ba5adc7bb90ea541ab7a567892434dc733e9aecb45cea1f895a28eba3076e22e49e3b361de1e942b874819dcc5680f38bcf437d029609f69a686

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Roaming\1A229\936A.A22
                                                                                                    Filesize

                                                                                                    1KB

                                                                                                    MD5

                                                                                                    7fcde0a4cfdea7611277bd63b08fc17e

                                                                                                    SHA1

                                                                                                    dae2211234b402f60450981170643a2ad49ddcfe

                                                                                                    SHA256

                                                                                                    b555146846e1611df12e5462e6d312e6d7a6a148ca848f6526f940cb0b16e98d

                                                                                                    SHA512

                                                                                                    bef2dc7b51970d0f2057e60df23c61b64b8ac54ea5d45390cc77222a0cad0152394a7204e6c163d16b1bc05d28e708eb09c58df11007c698b699edefc6cb2132

                                                                                                    Download Submit

                                                                                                  • C:\Users\Admin\AppData\Roaming\1A229\936A.A22
                                                                                                    Filesize

                                                                                                    600B

                                                                                                    MD5

                                                                                                    7ec046ab01948d07f2a08f9f8237ab25

                                                                                                    SHA1

                                                                                                    631728acebe8f6126787987cdacc43d763a3337f

                                                                                                    SHA256

                                                                                                    89b278caa843e46138f00199bbc456b1d049b99f5e20ba5e84949e5139e62626

                                                                                                    SHA512

                                                                                                    dc9f3131dd4bc54c699794a1e5b7899e1b4140de2d4e4c1484a3f0149462cbd062a7c8ee11c93e3a43b85ec58ceb7e92cb7b61a3b0fdeef1713961714c24bdeb

                                                                                                    Download Submit

                                                                                                  • memory/396-134-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                    Filesize

                                                                                                    436KB

                                                                                                    Download

                                                                                                  • memory/812-435-0x000001BB14BA0000-0x000001BB14BC0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/812-418-0x000001BB13B00000-0x000001BB13C00000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/812-448-0x000001BB151B0000-0x000001BB151D0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/812-422-0x000001BB14BE0000-0x000001BB14C00000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/812-417-0x000001BB13B00000-0x000001BB13C00000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/1576-248-0x0000000010000000-0x000000001001B000-memory.dmp

                                                                                                    Filesize

                                                                                                    108KB

                                                                                                    Download

                                                                                                  • memory/1576-72-0x0000000010000000-0x000000001001B000-memory.dmp

                                                                                                    Filesize

                                                                                                    108KB

                                                                                                    Download

                                                                                                  • memory/1576-56-0x0000000010000000-0x000000001001B000-memory.dmp

                                                                                                    Filesize

                                                                                                    108KB

                                                                                                    Download

                                                                                                  • memory/1576-1008-0x0000000010000000-0x000000001001B000-memory.dmp

                                                                                                    Filesize

                                                                                                    108KB

                                                                                                    Download

                                                                                                  • memory/1656-415-0x0000000004640000-0x0000000004641000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/1808-413-0x0000000010000000-0x000000001001B000-memory.dmp

                                                                                                    Filesize

                                                                                                    108KB

                                                                                                    Download

                                                                                                  • memory/1840-257-0x00000000049B0000-0x00000000049B1000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/2540-247-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                    Filesize

                                                                                                    112KB

                                                                                                    Download

                                                                                                  • memory/2640-53-0x0000000000400000-0x0000000000444000-memory.dmp

                                                                                                    Filesize

                                                                                                    272KB

                                                                                                    Download

                                                                                                  • memory/2640-23-0x0000000000400000-0x0000000000444000-memory.dmp

                                                                                                    Filesize

                                                                                                    272KB

                                                                                                    Download

                                                                                                  • memory/3180-1016-0x0000000004E60000-0x0000000004E61000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/3192-70-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                    Filesize

                                                                                                    436KB

                                                                                                    Download

                                                                                                  • memory/3328-295-0x0000019A60F40000-0x0000019A60F60000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3328-277-0x0000019A60920000-0x0000019A60940000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3328-264-0x0000019A60960000-0x0000019A60980000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3328-259-0x0000019A5FA00000-0x0000019A5FB00000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/3712-1024-0x000001AA5E2A0000-0x000001AA5E2C0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/3712-1019-0x000001AA5D140000-0x000001AA5D240000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/3816-562-0x0000000004950000-0x0000000004951000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/4000-59-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                    Filesize

                                                                                                    40KB

                                                                                                    Download

                                                                                                  • memory/4000-31-0x0000000000400000-0x000000000040A000-memory.dmp

                                                                                                    Filesize

                                                                                                    40KB

                                                                                                    Download

                                                                                                  • memory/4056-717-0x0000000004370000-0x0000000004371000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/4192-135-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                    Filesize

                                                                                                    436KB

                                                                                                    Download

                                                                                                  • memory/4192-71-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                    Filesize

                                                                                                    436KB

                                                                                                    Download

                                                                                                  • memory/4192-411-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                    Filesize

                                                                                                    436KB

                                                                                                    Download

                                                                                                  • memory/4528-746-0x000001F05C300000-0x000001F05C320000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/4528-724-0x000001F05BF40000-0x000001F05BF60000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/4528-733-0x000001F05BF00000-0x000001F05BF20000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/4528-720-0x000001F05AE00000-0x000001F05AF00000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/4528-719-0x000001F05AE00000-0x000001F05AF00000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/4760-569-0x000001AA982C0000-0x000001AA982E0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/4760-601-0x000001AA988A0000-0x000001AA988C0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/4760-579-0x000001AA98280000-0x000001AA982A0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/4760-564-0x000001AA97360000-0x000001AA97460000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/4808-865-0x00000000044A0000-0x00000000044A1000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    Download

                                                                                                  • memory/4876-868-0x000001EFA8000000-0x000001EFA8100000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/4876-872-0x000001EFA8EF0000-0x000001EFA8F10000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/4876-884-0x000001EFA8EB0000-0x000001EFA8ED0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/4876-897-0x000001EFA94C0000-0x000001EFA94E0000-memory.dmp

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    Download

                                                                                                  • memory/4876-869-0x000001EFA8000000-0x000001EFA8100000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/4876-867-0x000001EFA8000000-0x000001EFA8100000-memory.dmp

                                                                                                    Filesize

                                                                                                    1024KB

                                                                                                    Download

                                                                                                  • memory/5000-49-0x0000000010000000-0x000000001001B000-memory.dmp

                                                                                                    Filesize

                                                                                                    108KB

                                                                                                    Download

                                                                                                  • memory/5000-57-0x0000000010000000-0x000000001001B000-memory.dmp

                                                                                                    Filesize

                                                                                                    108KB

                                                                                                    Download