Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/D...

windows10-2004-x64

Resubmissions

21-11-2024 09:11

241121-k5wf4svpcj 10

21-11-2024 09:05

241121-k2nxvs1jby 10

Analysis

  • max time kernel
    183s
  • max time network
    184s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2024 09:11

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    https://github.com/Da2dalus/The-MALWARE-Repo

Score
10/10
badrabbitmimikatztroldeshbootkitdefense_evasiondiscoveryexecutionimpactpersistenceransomwaretrojanupx

Malware Config

Signatures

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit
  • Badrabbit family
    badrabbit
  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz
  • Mimikatz family
    mimikatz
  • Troldesh family
    troldesh
  • Troldesh, Shade, Encoder.858

    Troldesh is a ransomware spread by malspam.

    ransomwaretrojantroldesh
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • mimikatz is an open source tool to dump credentials on Windows 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 52 IoCs
  • Modifies registry class 52 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
    1⤵
      PID:2880
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
        PID:2888
      • C:\Windows\system32\taskhostw.exe
        taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
        1⤵
          PID:3008
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          1⤵
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:3440
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
            2⤵
            • Enumerates system info in registry
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:2216
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0c8446f8,0x7ffc0c844708,0x7ffc0c844718
              3⤵
                PID:3252
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,4583932054794793320,15413917205573895658,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
                3⤵
                  PID:1132
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,4583932054794793320,15413917205573895658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
                  3⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1080
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,4583932054794793320,15413917205573895658,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
                  3⤵
                    PID:1332
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4583932054794793320,15413917205573895658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
                    3⤵
                      PID:2288
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4583932054794793320,15413917205573895658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
                      3⤵
                        PID:1400
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,4583932054794793320,15413917205573895658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
                        3⤵
                          PID:1732
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,4583932054794793320,15413917205573895658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
                          3⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:872
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2036,4583932054794793320,15413917205573895658,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5472 /prefetch:8
                          3⤵
                            PID:4816
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4583932054794793320,15413917205573895658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
                            3⤵
                              PID:4224
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4583932054794793320,15413917205573895658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
                              3⤵
                                PID:3428
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4583932054794793320,15413917205573895658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
                                3⤵
                                  PID:4968
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4583932054794793320,15413917205573895658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
                                  3⤵
                                    PID:1288
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4583932054794793320,15413917205573895658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
                                    3⤵
                                      PID:764
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2036,4583932054794793320,15413917205573895658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1724 /prefetch:8
                                      3⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1620
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,4583932054794793320,15413917205573895658,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6208 /prefetch:2
                                      3⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4184
                                  • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Bumerang.exe
                                    "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Bumerang.exe"
                                    2⤵
                                    • Drops file in System32 directory
                                    • System Location Discovery: System Language Discovery
                                    PID:540
                                    • C:\Windows\SysWOW64\ddraw32.dll
                                      C:\Windows\system32\ddraw32.dll
                                      3⤵
                                      • Executes dropped EXE
                                      PID:1044
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 324
                                        4⤵
                                        • Program crash
                                        PID:4072
                                    • C:\Windows\SysWOW64\ddraw32.dll
                                      C:\Windows\system32\ddraw32.dll :C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Worm\Bumerang.exe
                                      3⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:3336
                                  • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\BadRabbit.exe
                                    "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\BadRabbit.exe"
                                    2⤵
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    PID:1828
                                    • C:\Windows\SysWOW64\rundll32.exe
                                      C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
                                      3⤵
                                      • Loads dropped DLL
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2708
                                      • C:\Windows\SysWOW64\cmd.exe
                                        /c schtasks /Delete /F /TN rhaegal
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1620
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /Delete /F /TN rhaegal
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1788
                                      • C:\Windows\SysWOW64\cmd.exe
                                        /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 928153272 && exit"
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4892
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 928153272 && exit"
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1320
                                      • C:\Windows\SysWOW64\cmd.exe
                                        /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 09:32:00
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2112
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 09:32:00
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1128
                                      • C:\Windows\D2D7.tmp
                                        "C:\Windows\D2D7.tmp" \\.\pipe\{47234D96-6DB5-4728-8F54-712EDAF4A99E}
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4184
                                      • C:\Windows\SysWOW64\cmd.exe
                                        /c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:
                                        4⤵
                                          PID:1760
                                        • C:\Windows\SysWOW64\cmd.exe
                                          /c schtasks /Delete /F /TN drogon
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1920
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            schtasks /Delete /F /TN drogon
                                            5⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:404
                                    • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\NoMoreRansom.exe
                                      "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\NoMoreRansom.exe"
                                      2⤵
                                      • Adds Run key to start application
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1224
                                    • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\satan.exe
                                      "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\satan.exe"
                                      2⤵
                                      • Suspicious use of SetThreadContext
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4728
                                      • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\satan.exe
                                        "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\satan.exe"
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2720
                                        • C:\Users\Admin\AppData\Roaming\Uvxeyx\teiq.exe
                                          "C:\Users\Admin\AppData\Roaming\Uvxeyx\teiq.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          PID:3400
                                          • C:\Users\Admin\AppData\Roaming\Uvxeyx\teiq.exe
                                            "C:\Users\Admin\AppData\Roaming\Uvxeyx\teiq.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:1880
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_b4006e4b.bat"
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3188
                                          • C:\Windows\System32\Conhost.exe
                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            5⤵
                                              PID:3380
                                      • C:\Windows\System32\vssadmin.exe
                                        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                        2⤵
                                        • Interacts with shadow copies
                                        PID:1396
                                      • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\PowerPoint.exe
                                        "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Ransomware\PowerPoint.exe"
                                        2⤵
                                        • Writes to the Master Boot Record (MBR)
                                        • System Location Discovery: System Language Discovery
                                        PID:3580
                                        • C:\Users\Admin\AppData\Local\Temp\sys3.exe
                                          C:\Users\Admin\AppData\Local\Temp\\sys3.exe
                                          3⤵
                                          • Executes dropped EXE
                                          • Writes to the Master Boot Record (MBR)
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2780
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                      1⤵
                                        PID:3568
                                      • C:\Windows\system32\DllHost.exe
                                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                        1⤵
                                          PID:3752
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:3840
                                          • C:\Windows\System32\RuntimeBroker.exe
                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                            1⤵
                                              PID:3908
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:3992
                                              • C:\Windows\System32\RuntimeBroker.exe
                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                1⤵
                                                  PID:4144
                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                                                  1⤵
                                                    PID:3372
                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                    1⤵
                                                      PID:3424
                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                      1⤵
                                                        PID:2292
                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                        1⤵
                                                          PID:2400
                                                        • C:\Windows\System32\rundll32.exe
                                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                          1⤵
                                                            PID:3156
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1044 -ip 1044
                                                            1⤵
                                                              PID:3428
                                                            • C:\Windows\system32\vssvc.exe
                                                              C:\Windows\system32\vssvc.exe
                                                              1⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2948
                                                            • C:\Windows\system32\LogonUI.exe
                                                              "LogonUI.exe" /flags:0x4 /state0:0xa396b855 /state1:0x41c64e6d
                                                              1⤵
                                                              • Drops desktop.ini file(s)
                                                              • Modifies data under HKEY_USERS
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2732
                                                            • C:\Windows\System32\rundll32.exe
                                                              C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                                              1⤵
                                                                PID:2388

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Reconnaissance

                                                              Resource Development

                                                              Initial Access

                                                              Execution

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Scheduled Task

                                                              1
                                                              T1053.005

                                                              Windows Management Instrumentation

                                                              1
                                                              T1047

                                                              Persistence

                                                              Boot or Logon Autostart Execution

                                                              1
                                                              T1547

                                                              Registry Run Keys / Startup Folder

                                                              1
                                                              T1547.001

                                                              Pre-OS Boot

                                                              1
                                                              T1542

                                                              Bootkit

                                                              1
                                                              T1542.003

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Scheduled Task

                                                              1
                                                              T1053.005

                                                              Privilege Escalation

                                                              Boot or Logon Autostart Execution

                                                              1
                                                              T1547

                                                              Registry Run Keys / Startup Folder

                                                              1
                                                              T1547.001

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Scheduled Task

                                                              1
                                                              T1053.005

                                                              Defense Evasion

                                                              Direct Volume Access

                                                              1
                                                              T1006

                                                              Indicator Removal

                                                              2
                                                              T1070

                                                              File Deletion

                                                              2
                                                              T1070.004

                                                              Modify Registry

                                                              2
                                                              T1112

                                                              Pre-OS Boot

                                                              1
                                                              T1542

                                                              Bootkit

                                                              1
                                                              T1542.003

                                                              Credential Access

                                                              Discovery

                                                              Browser Information Discovery

                                                              1
                                                              T1217

                                                              Query Registry

                                                              1
                                                              T1012

                                                              System Information Discovery

                                                              1
                                                              T1082

                                                              System Location Discovery

                                                              1
                                                              T1614

                                                              System Language Discovery

                                                              1
                                                              T1614.001

                                                              Lateral Movement

                                                              Collection

                                                              Command and Control

                                                              Exfiltration

                                                              Impact

                                                              Inhibit System Recovery

                                                              2
                                                              T1490

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-3227495264-2217614367-4027411560-1000\ReadOnly\LockScreen_O\LockScreen___1280_0720_notdimmed.jpg
                                                                Filesize

                                                                323KB

                                                                MD5

                                                                f4f6e0820032ea9123f62b33386fef0e

                                                                SHA1

                                                                ba96ac56aef41dcbdb120d13f97d79f86c3b4c84

                                                                SHA256

                                                                954ddf6b1c30b47e40cd04c0c47f8bb30d64ad8b4945142cb95e0959bd88f570

                                                                SHA512

                                                                c7d8bdc9b1d7ff386108c4da5c905734118c91e52bebc089de145ffbc2523b52f65085c950e15f297689fc74f2e92118be9101c3e124538275562d6b56a78d8c

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                Filesize

                                                                152B

                                                                MD5

                                                                fab8d8d865e33fe195732aa7dcb91c30

                                                                SHA1

                                                                2637e832f38acc70af3e511f5eba80fbd7461f2c

                                                                SHA256

                                                                1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

                                                                SHA512

                                                                39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                Filesize

                                                                152B

                                                                MD5

                                                                36988ca14952e1848e81a959880ea217

                                                                SHA1

                                                                a0482ef725657760502c2d1a5abe0bb37aebaadb

                                                                SHA256

                                                                d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

                                                                SHA512

                                                                d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                ab4e5f9016655c2a2db874ad221d00cc

                                                                SHA1

                                                                22e6468a25871ac1b7edc7961e27b6cee2daacc7

                                                                SHA256

                                                                4599bda206744c2071eeb83fbc6fac7acab7a361d7db7bfe4d96f44a58bbb8d4

                                                                SHA512

                                                                a7964dbd671c813ed871f94c8513129ddabc9b0b79f3dbc500eebabdea61740a79621d7b9fe699c5587524db7051aac28d5c3b9fc9b63e9792299d61d4550e5b

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                Filesize

                                                                573B

                                                                MD5

                                                                a6d346f58cbec0a6e4015327b25f1537

                                                                SHA1

                                                                750056e65a8b1c20b1a6051f5adcdf35821a6ac1

                                                                SHA256

                                                                1a715b1b5b62ef83ca8c62a18eddb3b5b6b738be2c654ab7a38cf22fdc8bea56

                                                                SHA512

                                                                74e563217a28cd6427739731f51ba2e35ee060c8ae6959d458d06a0416e17ffc6a49f8d0bbcb8d17cef144a45c36eb9f3b92305389ab0cfc5043f530d9f28d89

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                Filesize

                                                                5KB

                                                                MD5

                                                                b4613aa02b828c9d0f3c2a5a62e09dd9

                                                                SHA1

                                                                61fb63800203ad38d3c8f59b67fd03c7b09474ba

                                                                SHA256

                                                                827faf07cfeec248f16445bef269c47d2fc47c9a2ac46de5f248b51fef3aaf89

                                                                SHA512

                                                                0bf5f1bf7c8aa0646d95ccc539ef98ec3b6186fa1a32cbefa3d8cd6d2ab55c1e344089251cab90a5e6f44115da76ba4bf7d3057651a05330e89dc825048dbd04

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                Filesize

                                                                6KB

                                                                MD5

                                                                fc84d6300e17378e24e3a8ef77bbb4bc

                                                                SHA1

                                                                b388224cc57097fb97c136e7dd01963d5202bde1

                                                                SHA256

                                                                ddcc3b4719f40bf19308f44b22665ccd1534119e4632e35931442071385f6f97

                                                                SHA512

                                                                87f48bbbf89b59359cea340313c5860dafbc563cac470e31dd96f9a6dd1c0f344a6a3ef46522db7283a2a6518324d8268d624a0f94af55c939c9345e27c3efcd

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                Filesize

                                                                6KB

                                                                MD5

                                                                45eccad507000018f92ef8d4fe791e61

                                                                SHA1

                                                                5c685a7aac45c945ff35ebc4231007924a46c3dc

                                                                SHA256

                                                                68c139ec6b9c2d32faac47d81751a609556ee89f203ef3d66b107e6afacd5584

                                                                SHA512

                                                                aef2a1160d632937461e1e6e66997799cbc681f1cba2b7b69b9b93d5762a7664a5b9f7ec776b05108778102e1d190cb68d5169623e305e523b9d0e859e4cc308

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                e6b5da539ce86bc7d63c801018b08948

                                                                SHA1

                                                                6d4c6ef1aacbc00b6246975e46040df0eeb25bc6

                                                                SHA256

                                                                b24150c0f40ebef0b98089bf9121c29cc3319623b4b3e03eb718e76e349a8cae

                                                                SHA512

                                                                f42cbd0d7aa3cb6cd6574b3f077343b7e8a646d0e1b4257d570e609edfc9313949a8720591745ef1fc64509d3ac2ebcd71a5a9fbca9bcb42f0860c0e473006c0

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a1464.TMP
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                ad130b626ac4feeb12434f25ef5d651c

                                                                SHA1

                                                                bf7f3d0e83cded909f33d0922067a8874dad5d0a

                                                                SHA256

                                                                f8b8022e3b96bbea18ef5b01a15d619ad2bb81bea6afebe277a9c6448961e567

                                                                SHA512

                                                                54349cd92b72647e29341789d4d50b6ab345ea696818fde91ee224b9bf93635cc2a1430633bd439d72c96d6f9ce586f722c75416a359a2721621c7f24a237d87

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                Filesize

                                                                16B

                                                                MD5

                                                                6752a1d65b201c13b62ea44016eb221f

                                                                SHA1

                                                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                SHA256

                                                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                SHA512

                                                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                Filesize

                                                                11KB

                                                                MD5

                                                                8b2a12cbfbc38c3a165aeab5b390ef38

                                                                SHA1

                                                                c75cab902f96ae607810e42c195370e96df97d37

                                                                SHA256

                                                                dce43798c1ab1c7a365a67d81062e0f008f65440afce24ec76ef9cffa9d03e4c

                                                                SHA512

                                                                e3db15b80385f98f8440d15d95330a53a1a788abc8b47c0ae3f8ea88f3a74c5622170eadfd247bceff3057f437ff78658bf64bbfc82451bc072ce4b7aa595c14

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                Filesize

                                                                11KB

                                                                MD5

                                                                51e38a2cfc0f2652177aee776051169a

                                                                SHA1

                                                                cee81ec7a4d4a620b1dc2e024737bd786c72e328

                                                                SHA256

                                                                e612034c6d63610a4b6c637ef8bbe1d68537836f9b59e2e8cb6d2ee9b44c8023

                                                                SHA512

                                                                045cb4c257bab608406c8e191def091b3f95aa52a3d255c41587fc8ae791b3ebd6052c4f5ee15d143520f2a18bca2732ed1c842f28679ba32fbfc2f4090c0e77

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                Filesize

                                                                10KB

                                                                MD5

                                                                c58d410800f3a5c3f794c1f840cf3afe

                                                                SHA1

                                                                c087ab3727777dbb0053c911984634e2a6634bce

                                                                SHA256

                                                                65e67a071db4ce752555ba40a5301212d1c3f1a172a37095508d8abef0c9c504

                                                                SHA512

                                                                4b4eb1719692675fa441de5cce153baf5146dbcc5469ebadd197fa495c546a83b382712d273281a2fdd77869a2e0c41670455899c97cea6c06307ac1dd47d730

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\sys3.exe
                                                                Filesize

                                                                136KB

                                                                MD5

                                                                70108103a53123201ceb2e921fcfe83c

                                                                SHA1

                                                                c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3

                                                                SHA256

                                                                9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d

                                                                SHA512

                                                                996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\systm.txt
                                                                Filesize

                                                                98B

                                                                MD5

                                                                2671b44933c49155e153242c601b1f65

                                                                SHA1

                                                                bd248015ff65c1b6d07c773111013f107c98c048

                                                                SHA256

                                                                8b93dcfe006da7c3fba43a9f8ae8bc4e7c77cbee15a95649c74da28667a60fe4

                                                                SHA512

                                                                1195fcbd5e18c2dc9556f89b4542ed65950400272bafa0ace3420b85ef31727e63829ab4befa513d18095a2659bf234296130575fbde2522c757f541db3e4b51

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\tmp_b4006e4b.bat
                                                                Filesize

                                                                290B

                                                                MD5

                                                                35c9735820f6c42a894f9bd7d925385f

                                                                SHA1

                                                                cd026f11381829f2cb0558c4ad1031a94361b95d

                                                                SHA256

                                                                b34471239d241ffd963c1fbc85fa41c06c132a6d9e8da6471bb6e4761003d060

                                                                SHA512

                                                                c3dff726ce6995795a81779a3936409569afb692dfcad18fcc128b5ad939262242110abb52b981a3cdff13f6eaf8eb0fd88bbada7c9d606d9a59f575755dde67

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Uvxeyx\teiq.exe
                                                                Filesize

                                                                67KB

                                                                MD5

                                                                4771ac2f4dcffbf32179f0c750b1c853

                                                                SHA1

                                                                c56cdd299c67033d338ca64c77fdc465d7c30c9f

                                                                SHA256

                                                                0f8df52c713f80901c263908b0bf9d055d36849569ff9eed0717e926bb012ccc

                                                                SHA512

                                                                fd7fcf78c29ff772e630b79312f39b6f3e8733ac3292aea2fb2d09efb928ab535850368079b5b56e2d983ba3e6f9d716c6d56c3f5c63537eec3568aeb31265e8

                                                                Download Submit

                                                              • C:\Windows\D2D7.tmp
                                                                Filesize

                                                                60KB

                                                                MD5

                                                                347ac3b6b791054de3e5720a7144a977

                                                                SHA1

                                                                413eba3973a15c1a6429d9f170f3e8287f98c21c

                                                                SHA256

                                                                301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c

                                                                SHA512

                                                                9a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787

                                                                Download Submit

                                                              • C:\Windows\SysWOW64\ddraw32.dll
                                                                Filesize

                                                                22KB

                                                                MD5

                                                                f1ac5c806ed1e188c54e0861cbf1f358

                                                                SHA1

                                                                b2a2895a0eae5e2ef8d10ed0f079d0fcfea9585a

                                                                SHA256

                                                                87b7d23ab8720f1087d50a902244cbbdc25245b29da9bfa54698a4545b82afc4

                                                                SHA512

                                                                ddb61b46a71db7401984e1917f0ef1498883cff76f0a98ff8d65acb08b6d7181511ca57a1e23c7482fc9d26afcf48b662896375b80eff4b2e0d08b7b55d9b98f

                                                                Download Submit

                                                              • C:\Windows\infpub.dat
                                                                Filesize

                                                                401KB

                                                                MD5

                                                                1d724f95c61f1055f0d02c2154bbccd3

                                                                SHA1

                                                                79116fe99f2b421c52ef64097f0f39b815b20907

                                                                SHA256

                                                                579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

                                                                SHA512

                                                                f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

                                                                Download Submit

                                                              • \??\pipe\LOCAL\crashpad_2216_ZJEQLKKKVXTXCTFJ
                                                                MD5

                                                                d41d8cd98f00b204e9800998ecf8427e

                                                                SHA1

                                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                SHA256

                                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                SHA512

                                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                Download Submit

                                                              • memory/540-274-0x0000000000400000-0x0000000000410000-memory.dmp

                                                                Filesize

                                                                64KB

                                                                Download

                                                              • memory/540-265-0x0000000000400000-0x0000000000410000-memory.dmp

                                                                Filesize

                                                                64KB

                                                                Download

                                                              • memory/1044-275-0x0000000000400000-0x0000000000410000-memory.dmp

                                                                Filesize

                                                                64KB

                                                                Download

                                                              • memory/1224-367-0x0000000000400000-0x00000000005DE000-memory.dmp

                                                                Filesize

                                                                1.9MB

                                                                Download

                                                              • memory/1224-365-0x0000000000400000-0x00000000005DE000-memory.dmp

                                                                Filesize

                                                                1.9MB

                                                                Download

                                                              • memory/1224-364-0x0000000000400000-0x00000000005DE000-memory.dmp

                                                                Filesize

                                                                1.9MB

                                                                Download

                                                              • memory/1224-363-0x0000000000400000-0x00000000005DE000-memory.dmp

                                                                Filesize

                                                                1.9MB

                                                                Download

                                                              • memory/1880-387-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                Filesize

                                                                92KB

                                                                Download

                                                              • memory/1880-385-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                Filesize

                                                                92KB

                                                                Download

                                                              • memory/2708-298-0x0000000001220000-0x0000000001288000-memory.dmp

                                                                Filesize

                                                                416KB

                                                                Download

                                                              • memory/2708-289-0x0000000001220000-0x0000000001288000-memory.dmp

                                                                Filesize

                                                                416KB

                                                                Download

                                                              • memory/2708-295-0x0000000001220000-0x0000000001288000-memory.dmp

                                                                Filesize

                                                                416KB

                                                                Download

                                                              • memory/2720-376-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                Filesize

                                                                72KB

                                                                Download

                                                              • memory/2720-377-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                Filesize

                                                                72KB

                                                                Download

                                                              • memory/2720-383-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                Filesize

                                                                72KB

                                                                Download

                                                              • memory/2780-459-0x000000002AA00000-0x000000002AA24000-memory.dmp

                                                                Filesize

                                                                144KB

                                                                Download

                                                              • memory/2880-393-0x00000223CB1A0000-0x00000223CB1B7000-memory.dmp

                                                                Filesize

                                                                92KB

                                                                Download

                                                              • memory/2888-394-0x000002853F240000-0x000002853F257000-memory.dmp

                                                                Filesize

                                                                92KB

                                                                Download

                                                              • memory/3008-395-0x0000025DD81B0000-0x0000025DD81C7000-memory.dmp

                                                                Filesize

                                                                92KB

                                                                Download

                                                              • memory/3336-273-0x0000000000400000-0x0000000000410000-memory.dmp

                                                                Filesize

                                                                64KB

                                                                Download

                                                              • memory/3336-281-0x0000000000400000-0x0000000000410000-memory.dmp

                                                                Filesize

                                                                64KB

                                                                Download

                                                              • memory/3372-408-0x00000244CA0E0000-0x00000244CA0F7000-memory.dmp

                                                                Filesize

                                                                92KB

                                                                Download

                                                              • memory/3400-390-0x0000000000170000-0x0000000000200000-memory.dmp

                                                                Filesize

                                                                576KB

                                                                Download

                                                              • memory/3400-388-0x0000000000410000-0x00000000004CE000-memory.dmp

                                                                Filesize

                                                                760KB

                                                                Download

                                                              • memory/3400-389-0x00000000006B0000-0x0000000000979000-memory.dmp

                                                                Filesize

                                                                2.8MB

                                                                Download

                                                              • memory/3440-404-0x000000000A770000-0x000000000A787000-memory.dmp

                                                                Filesize

                                                                92KB

                                                                Download

                                                              • memory/3440-405-0x000000000A770000-0x000000000A787000-memory.dmp

                                                                Filesize

                                                                92KB

                                                                Download

                                                              • memory/3440-402-0x000000000A770000-0x000000000A787000-memory.dmp

                                                                Filesize

                                                                92KB

                                                                Download

                                                              • memory/3440-396-0x000000000A770000-0x000000000A787000-memory.dmp

                                                                Filesize

                                                                92KB

                                                                Download

                                                              • memory/3440-403-0x000000000A770000-0x000000000A787000-memory.dmp

                                                                Filesize

                                                                92KB

                                                                Download

                                                              • memory/3440-401-0x000000000A770000-0x000000000A787000-memory.dmp

                                                                Filesize

                                                                92KB

                                                                Download

                                                              • memory/3568-397-0x00000222B7350000-0x00000222B7367000-memory.dmp

                                                                Filesize

                                                                92KB

                                                                Download

                                                              • memory/3580-454-0x000000002AA00000-0x000000002AA24000-memory.dmp

                                                                Filesize

                                                                144KB

                                                                Download

                                                              • memory/3580-460-0x000000002AA00000-0x000000002AA24000-memory.dmp

                                                                Filesize

                                                                144KB

                                                                Download

                                                              • memory/3752-398-0x000001BAC28D0000-0x000001BAC28E7000-memory.dmp

                                                                Filesize

                                                                92KB

                                                                Download

                                                              • memory/3840-399-0x00000271D8940000-0x00000271D8957000-memory.dmp

                                                                Filesize

                                                                92KB

                                                                Download

                                                              • memory/3908-400-0x000001BA1F900000-0x000001BA1F917000-memory.dmp

                                                                Filesize

                                                                92KB

                                                                Download

                                                              • memory/3992-406-0x0000020C14450000-0x0000020C14467000-memory.dmp

                                                                Filesize

                                                                92KB

                                                                Download

                                                              • memory/4144-407-0x00000265F1A20000-0x00000265F1A37000-memory.dmp

                                                                Filesize

                                                                92KB

                                                                Download