Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

fc8d6bfcb4...18.exe

windows7-x64

10

fc8d6bfcb4...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    86s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/09/2024, 15:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fc8d6bfcb4115e9c741058fc5c7ebb92_JaffaCakes118.exe

  • Size

    266KB

  • MD5

    fc8d6bfcb4115e9c741058fc5c7ebb92

  • SHA1

    483fce2ca40e086035ef3b283aa62530c4956b2e

  • SHA256

    515b7d7a5cab355f22ae07274882025435acf0c8c134eed3882420a88386e44a

  • SHA512

    6a423854aea29dc75362f9640a4b4cd743d8eddede7c0726a9df9736da27956f3df1464cb5cdd22c31db307f20aa6c2d502081e142f5ce055613c8cc3b236760

  • SSDEEP

    6144:y6Nd1IKMXEqTjBUc600u5eGXEBYB6hkw+Dp9mIBPDAVu1kc5:1Nd1IVEqfDs6eGXEBzn+99aVuL5

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 14 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 25 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\fc8d6bfcb4115e9c741058fc5c7ebb92_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fc8d6bfcb4115e9c741058fc5c7ebb92_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3980
    • C:\Users\Admin\AppData\Local\Temp\fc8d6bfcb4115e9c741058fc5c7ebb92_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\fc8d6bfcb4115e9c741058fc5c7ebb92_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\D26D0\A4D69.exe%C:\Users\Admin\AppData\Roaming\D26D0
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1960
    • C:\Users\Admin\AppData\Local\Temp\fc8d6bfcb4115e9c741058fc5c7ebb92_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\fc8d6bfcb4115e9c741058fc5c7ebb92_JaffaCakes118.exe startC:\Program Files (x86)\D0DA2\lvvm.exe%C:\Program Files (x86)\D0DA2
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2716
    • C:\Program Files (x86)\LP\69FD\27D6.tmp
      "C:\Program Files (x86)\LP\69FD\27D6.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2508
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2188
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1216
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2920
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2560
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3188
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1232
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    PID:4216
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3308
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2236
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:444
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1360
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4384
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4684
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4488
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:772
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:1960
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3864
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2764
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4292
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2248
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:4488
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:3848
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:692
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4200
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:980
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5004
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:368
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3736
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1632
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4920
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:4540
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2492
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1628
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2488
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2044
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5084
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:5000
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3636
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1256
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    PID:4792
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:4284
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:1772
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:1624
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:4968
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3456
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4016
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:4496
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:392
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3456
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3700
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:5084
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:1036
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:3124
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:2716
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:2356
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:1480
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:3688
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:2256
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:4224
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:4596
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:2740
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:3608
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:772
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4960
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:4240
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:3164
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:5008
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:1232
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:2888
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:436
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:184
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:1920
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:4796
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:3552
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:2136

                                                                        Network

                                                                        MITRE ATT&CK Enterprise v15

                                                                        Reconnaissance

                                                                        Resource Development

                                                                        Initial Access

                                                                        Execution

                                                                        Persistence

                                                                        Boot or Logon Autostart Execution

                                                                        2
                                                                        T1547

                                                                        Active Setup

                                                                        1
                                                                        T1547.014

                                                                        Registry Run Keys / Startup Folder

                                                                        1
                                                                        T1547.001

                                                                        Create or Modify System Process

                                                                        1
                                                                        T1543

                                                                        Windows Service

                                                                        1
                                                                        T1543.003

                                                                        Privilege Escalation

                                                                        Boot or Logon Autostart Execution

                                                                        2
                                                                        T1547

                                                                        Active Setup

                                                                        1
                                                                        T1547.014

                                                                        Registry Run Keys / Startup Folder

                                                                        1
                                                                        T1547.001

                                                                        Create or Modify System Process

                                                                        1
                                                                        T1543

                                                                        Windows Service

                                                                        1
                                                                        T1543.003

                                                                        Defense Evasion

                                                                        Modify Registry

                                                                        5
                                                                        T1112

                                                                        Credential Access

                                                                        Credentials from Password Stores

                                                                        1
                                                                        T1555

                                                                        Credentials from Web Browsers

                                                                        1
                                                                        T1555.003

                                                                        Unsecured Credentials

                                                                        3
                                                                        T1552

                                                                        Credentials In Files

                                                                        3
                                                                        T1552.001

                                                                        Discovery

                                                                        Peripheral Device Discovery

                                                                        2
                                                                        T1120

                                                                        Query Registry

                                                                        4
                                                                        T1012

                                                                        System Information Discovery

                                                                        2
                                                                        T1082

                                                                        System Location Discovery

                                                                        1
                                                                        T1614

                                                                        System Language Discovery

                                                                        1
                                                                        T1614.001

                                                                        Lateral Movement

                                                                        Collection

                                                                        Data from Local System

                                                                        2
                                                                        T1005

                                                                        Command and Control

                                                                        Exfiltration

                                                                        Impact

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\Program Files (x86)\LP\69FD\27D6.tmp
                                                                          Filesize

                                                                          96KB

                                                                          MD5

                                                                          1af9198aefc1a89dce2e8f9227ae8c64

                                                                          SHA1

                                                                          718e24e7694b5d98a78455bfb8376e849aba5de7

                                                                          SHA256

                                                                          a0dc0e890177fe303dc2cd1d94f582325b42f48df6ddada24bc5f52dbad14a02

                                                                          SHA512

                                                                          4bfcc7c92baf26285ba33952bc87eeb994c502828b57feb3d5e90fe3ee53f754242ccfc4be61382bfd436bbb9890f50d83d9f0dce36c8d059a7a9874c0c646c8

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                          Filesize

                                                                          471B

                                                                          MD5

                                                                          e97f8ff623c9dca38b905f119c583e55

                                                                          SHA1

                                                                          30d314121e48bef77c20571143e49b778d59e73d

                                                                          SHA256

                                                                          b8fece7706e939895e00d7df5a754fcdb714eef4cc07a86c5ae54980fa1527f8

                                                                          SHA512

                                                                          7d2beefe263c576fbc0f1eb0f3023604d9cda7c5f8244d3570aee507046eb8e5bd710ec066ac000e0b72a4cf4ae279102067b781cd5de5a1e7d623631bac6589

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                          Filesize

                                                                          420B

                                                                          MD5

                                                                          121cecb045b00382d2670c907073d24f

                                                                          SHA1

                                                                          6513e86865051f49caca97017a8518112bb054aa

                                                                          SHA256

                                                                          c0aea42033c13184b83e881542fb077bb557378c5300bea314a252b2123a259a

                                                                          SHA512

                                                                          8e658b73008e31376996608075f5b4cc315140c31dc70fccdb9b74ece4415c67368757f3fda2e21cf581d2d13ea9547d20c669f07ec2dfcff2d6ab8074e7acab

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                          Filesize

                                                                          2KB

                                                                          MD5

                                                                          2b1e568719d5ecde8ac4e95e2c247744

                                                                          SHA1

                                                                          1908744731bb45f5225c59e1afa33d69127fac9b

                                                                          SHA256

                                                                          ad6908dd7b9251d089307947d5d34216c05bd81c3b2026208951a7a69d80dda7

                                                                          SHA512

                                                                          e2086ae5840c05657bbc4d85b72df55056fae381191dea9605a78995891b4d1cb0248ed1946104a4f44bf618e5f0eb198a9698812f28314e529a32c8aeb37ad7

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
                                                                          Filesize

                                                                          36KB

                                                                          MD5

                                                                          0e2a09c8b94747fa78ec836b5711c0c0

                                                                          SHA1

                                                                          92495421ad887f27f53784c470884802797025ad

                                                                          SHA256

                                                                          0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                          SHA512

                                                                          61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
                                                                          Filesize

                                                                          36KB

                                                                          MD5

                                                                          ab0262f72142aab53d5402e6d0cb5d24

                                                                          SHA1

                                                                          eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                          SHA256

                                                                          20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                          SHA512

                                                                          bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\RMU4N5WP\microsoft.windows[1].xml
                                                                          Filesize

                                                                          97B

                                                                          MD5

                                                                          1e30d8c8ef07e3c98200641a90d1ae95

                                                                          SHA1

                                                                          b8e86446e5ff4d10984af769b912d8d34313da54

                                                                          SHA256

                                                                          0d0b29673b1fcaea71df3130c5c5cf31a8f8bbd16b60f9861b4a42665c934493

                                                                          SHA512

                                                                          bc0ca2e71bcc7f3680c683f91a87204d614f4bac56750619f449194f6aa69d983f526b4f73a5fed083ad56d648dfcce3a80c25b93fd07e76b616f14b219b6f04

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\D26D0\0DA2.26D
                                                                          Filesize

                                                                          596B

                                                                          MD5

                                                                          727e0b2dff8ac611262c0ce52bfae820

                                                                          SHA1

                                                                          cfb6b534ddf93df65f4e5ef745e0b0c11c296cd6

                                                                          SHA256

                                                                          ea34b814e2eb05b9565843929afd5d2d5cd122f5cf07e2121cd2fc3c322ad173

                                                                          SHA512

                                                                          07d0eb0b252baef29641036cf05ad640d64709dcc931c77f990d6068ffd2b72e7341438bfb35a12e33539435c03ff7202697b43804c6123b08146d79db10deed

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\D26D0\0DA2.26D
                                                                          Filesize

                                                                          996B

                                                                          MD5

                                                                          8ecd996e086350cbce1c642ff8154607

                                                                          SHA1

                                                                          34cc1e2e0b8cbf01cd8ae723aa632441f8402005

                                                                          SHA256

                                                                          e909b41cfac09e3cbc311f884efdcb9085c9a1237337cf4ad14bd8ea0c760095

                                                                          SHA512

                                                                          530f692ed46503377011a40495675c6ae7502d09a6569a4527218cd338b9be39633363dd951a65f6e08487a2c2afe0f871a0f0c365934b5f1e21604c6badc77c

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\D26D0\0DA2.26D
                                                                          Filesize

                                                                          600B

                                                                          MD5

                                                                          c8e8cc371fefdbc562e5c6c043cda1e7

                                                                          SHA1

                                                                          0816c05d7c4f1d288d578e8d03037437ca4c7cbe

                                                                          SHA256

                                                                          020c19be7f043897f5ad260a055154ca8fa79217cf7074d6d2133f8d8c31a569

                                                                          SHA512

                                                                          5b66f8a19848d13e1cf0b4b78adbc8a714b956067a6dd5121edd9a42620da0e66faea53114639875f13d7885a1a22ebd01634721ae0237aca94447c21ccdbde8

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\D26D0\0DA2.26D
                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          7f9bac0ba3cf0f7bdcac2d3334f1e597

                                                                          SHA1

                                                                          9331165a495fc6e8b4684fe8772fbb0c366d39a3

                                                                          SHA256

                                                                          557def939afc6adcd749c0da6344335ab9aa9ee29bde7a9e9c95b22bbb8e0228

                                                                          SHA512

                                                                          5f9666ae2058c42f9bffe9449d09e78b1b73fc990e126f08dbc7058047508ed3596e6b01d3c98a185922e76fd3c9c43241593e6fdccd0d3c62c542118a6bf7da

                                                                          Download Submit

                                                                        • memory/368-1351-0x000001EB58BE0000-0x000001EB58C00000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/368-1339-0x000001EB585D0000-0x000001EB585F0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/368-1330-0x000001EB58820000-0x000001EB58840000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/444-582-0x0000000003FA0000-0x0000000003FA1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/772-738-0x0000021654510000-0x0000021654530000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/772-749-0x00000216544D0000-0x00000216544F0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/772-769-0x0000021654AE0000-0x0000021654B00000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/980-1322-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/1232-285-0x000001B30A9E0000-0x000001B30AA00000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/1232-316-0x000001B30AFB0000-0x000001B30AFD0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/1232-295-0x000001B30A9A0000-0x000001B30A9C0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/1232-280-0x000001AB08B00000-0x000001AB08C00000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/1232-281-0x000001AB08B00000-0x000001AB08C00000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/1232-282-0x000001AB08B00000-0x000001AB08C00000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/1628-1617-0x000001C19F800000-0x000001C19F900000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/1960-875-0x00000000014E0000-0x00000000014E1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/1960-16-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                          Filesize

                                                                          424KB

                                                                          Download

                                                                        • memory/2236-455-0x000001F5E6130000-0x000001F5E6150000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/2236-443-0x000001F5E5D20000-0x000001F5E5D40000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/2236-428-0x000001F5E4C00000-0x000001F5E4D00000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/2236-432-0x000001F5E5D60000-0x000001F5E5D80000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/2508-696-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                          Filesize

                                                                          108KB

                                                                          Download

                                                                        • memory/2560-279-0x00000000031E0000-0x00000000031E1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/2716-120-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                          Filesize

                                                                          424KB

                                                                          Download

                                                                        • memory/2764-877-0x00000261A8E00000-0x00000261A8F00000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/2764-878-0x00000261A8E00000-0x00000261A8F00000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/2764-882-0x00000261A9E70000-0x00000261A9E90000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/2764-879-0x00000261A8E00000-0x00000261A8F00000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/2764-890-0x00000261A9E30000-0x00000261A9E50000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/2764-914-0x00000261AA240000-0x00000261AA260000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/3736-1467-0x00000000042A0000-0x00000000042A1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/3848-1172-0x00000000032A0000-0x00000000032A1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/3980-723-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                          Filesize

                                                                          424KB

                                                                          Download

                                                                        • memory/3980-13-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                          Filesize

                                                                          424KB

                                                                          Download

                                                                        • memory/3980-0-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                          Filesize

                                                                          424KB

                                                                          Download

                                                                        • memory/3980-15-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                          Filesize

                                                                          416KB

                                                                          Download

                                                                        • memory/3980-2-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                          Filesize

                                                                          416KB

                                                                          Download

                                                                        • memory/3980-3-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                          Filesize

                                                                          424KB

                                                                          Download

                                                                        • memory/3980-1613-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                          Filesize

                                                                          424KB

                                                                          Download

                                                                        • memory/3980-118-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                          Filesize

                                                                          424KB

                                                                          Download

                                                                        • memory/4200-1175-0x0000020358700000-0x0000020358800000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/4200-1179-0x0000020B5A820000-0x0000020B5A840000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4200-1199-0x0000020B5ABE0000-0x0000020B5AC00000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4200-1189-0x0000020B5A5D0000-0x0000020B5A5F0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4216-424-0x00000000043A0000-0x00000000043A1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/4292-1024-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/4384-613-0x00000154ECFD0000-0x00000154ECFF0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4384-601-0x00000154ECBC0000-0x00000154ECBE0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4384-590-0x00000154ECC00000-0x00000154ECC20000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4488-1063-0x0000024FC9500000-0x0000024FC9520000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4488-1043-0x0000024FC8EE0000-0x0000024FC8F00000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4488-1031-0x0000024FC8F20000-0x0000024FC8F40000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4540-1615-0x0000000004420000-0x0000000004421000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/4684-730-0x00000000040F0000-0x00000000040F1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/4920-1471-0x0000023AB4000000-0x0000023AB4100000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/4920-1470-0x0000023AB4000000-0x0000023AB4100000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/4920-1469-0x0000023AB4000000-0x0000023AB4100000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/4920-1483-0x0000023AB5050000-0x0000023AB5070000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4920-1495-0x0000023AB5460000-0x0000023AB5480000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4920-1474-0x0000023AB5090000-0x0000023AB50B0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download