Overview

overview

10

Static

static

3

Client.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    104s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2024 21:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Client.exe

  • Size

    440KB

  • MD5

    6527754a84c08c132797ac0e41232027

  • SHA1

    f42f9df429a4fe20f02039d5628bbb5f8c334265

  • SHA256

    b0a58d3f76d8ec2462e59c1ca89b6131ad81a7fabc43b5e7d3bd883311035d8a

  • SHA512

    ebcba42e29d8aba555479ebf6841bc44c9f5542edf51728d41bfa65fadb847c2e849d64a2dbe5634bcbafa884d04027b0d29999f7d640d7045a05dfb8d610480

  • SSDEEP

    6144:CuuPnduxK8e6VlWT8b9LBlTsjp6PvZhb5z9YivZQw:5uPnkPVle8lWpgz1ZQ

Score
10/10
umbraldiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1308428735950622800/sWvRLs-dtmRQlMNZW9kIl-o0w8Hh4Hm0B7f93c-PShVCWNK3T9twd6vncAOynKZpzZfx

Signatures

  • Detect Umbral payload 2 IoCs
  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Umbral family
    umbral
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Start PowerShell.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 30 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 57 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client.exe
    "C:\Users\Admin\AppData\Local\Temp\Client.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Solara" /tr "C:\Program Files\xdwdGIMP Upgrade.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1004
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Solara" /tr "C:\Program Files\xdwdGIMP Upgrade.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4856
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Program Files\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4576
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "svchost" /tr "C:\Program Files\xdwdGIMP Upgrade.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1428
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdAdobe Photoshop.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3768
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdAdobe Photoshop.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2092
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\lt13ez4m.pml.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2956
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\lt13ez4m.pml.exe"'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2324
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\lt13ez4m.pml.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\lt13ez4m.pml.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3688
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic.exe" csproduct get uuid
            5⤵
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            PID:2360
          • C:\Windows\SYSTEM32\attrib.exe
            "attrib.exe" +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\lt13ez4m.pml.exe"
            5⤵
            • Views/modifies file attributes
            PID:2920
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\lt13ez4m.pml.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            PID:464
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            PID:4224
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            PID:2200
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
            5⤵
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            PID:1428
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic.exe" os get Caption
            5⤵
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            PID:2380
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic.exe" computersystem get totalphysicalmemory
            5⤵
            • Loads dropped DLL
            PID:1460
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic.exe" csproduct get uuid
            5⤵
            • Loads dropped DLL
            PID:2680
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Loads dropped DLL
            PID:1616
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic" path win32_VideoController get name
            5⤵
            • Loads dropped DLL
            • Detects videocard installed
            PID:464
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\lt13ez4m.pml.exe" && pause
            5⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:1748
            • C:\Windows\system32\PING.EXE
              ping localhost
              6⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:3132
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtASks /deLeTe /F /Tn "Solara" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4692
      • C:\Windows\system32\schtasks.exe
        schtASks /deLeTe /F /Tn "Solara"
        3⤵
          PID:3396
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" /C taskkill /im explorer.exe /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4992
        • C:\Windows\system32\taskkill.exe
          taskkill /im explorer.exe /f
          3⤵
          • Kills process with taskkill
          PID:2584
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtASks /deLeTe /F /Tn "svchost" & exit
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1592
        • C:\Windows\system32\schtasks.exe
          schtASks /deLeTe /F /Tn "svchost"
          3⤵
            PID:1608
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtASks /deLeTe /F /Tn "svchost" & exit
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1856
          • C:\Windows\system32\schtasks.exe
            schtASks /deLeTe /F /Tn "svchost"
            3⤵
              PID:3928
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB84F.tmp.bat""
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2380
            • C:\Windows\system32\timeout.exe
              timeout 5
              3⤵
              • Delays execution with timeout.exe
              PID:1912
            • C:\Windows\explorer.exe
              explorer.exe
              3⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies registry class
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:3612
            • C:\Windows\system32\taskkill.exe
              taskkill /im xdwdGIMP Upgrade.exe /f
              3⤵
              • Kills process with taskkill
              PID:1660
            • C:\Windows\system32\timeout.exe
              timeout 3
              3⤵
              • Delays execution with timeout.exe
              PID:3456
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
          • Loads dropped DLL
          PID:1584
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:3172
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1696
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:3600
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1452
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:3420
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4136
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Modifies registry class
          • Suspicious use of SendNotifyMessage
          PID:4380
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:412
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3324
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:1044
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:1452
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:4920
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3536
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3736
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:1416
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:916
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:4196
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:3056
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:1560
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:3848
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:3736
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:4384
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:1612
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:2296
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:4496
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:2444
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:4600
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:3156
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:3184
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:388
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:3732
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:4260
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:2284

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Reconnaissance

                                                            Resource Development

                                                            Initial Access

                                                            Execution

                                                            Command and Scripting Interpreter

                                                            1
                                                            T1059

                                                            PowerShell

                                                            1
                                                            T1059.001

                                                            Scheduled Task/Job

                                                            1
                                                            T1053

                                                            Scheduled Task

                                                            1
                                                            T1053.005

                                                            Persistence

                                                            Boot or Logon Autostart Execution

                                                            3
                                                            T1547

                                                            Active Setup

                                                            1
                                                            T1547.014

                                                            Registry Run Keys / Startup Folder

                                                            1
                                                            T1547.001

                                                            Winlogon Helper DLL

                                                            1
                                                            T1547.004

                                                            Event Triggered Execution

                                                            1
                                                            T1546

                                                            AppInit DLLs

                                                            1
                                                            T1546.010

                                                            Scheduled Task/Job

                                                            1
                                                            T1053

                                                            Scheduled Task

                                                            1
                                                            T1053.005

                                                            Privilege Escalation

                                                            Boot or Logon Autostart Execution

                                                            3
                                                            T1547

                                                            Active Setup

                                                            1
                                                            T1547.014

                                                            Registry Run Keys / Startup Folder

                                                            1
                                                            T1547.001

                                                            Winlogon Helper DLL

                                                            1
                                                            T1547.004

                                                            Event Triggered Execution

                                                            1
                                                            T1546

                                                            AppInit DLLs

                                                            1
                                                            T1546.010

                                                            Scheduled Task/Job

                                                            1
                                                            T1053

                                                            Scheduled Task

                                                            1
                                                            T1053.005

                                                            Defense Evasion

                                                            Hide Artifacts

                                                            1
                                                            T1564

                                                            Hidden Files and Directories

                                                            1
                                                            T1564.001

                                                            Modify Registry

                                                            4
                                                            T1112

                                                            Credential Access

                                                            Credentials from Password Stores

                                                            1
                                                            T1555

                                                            Credentials from Web Browsers

                                                            1
                                                            T1555.003

                                                            Unsecured Credentials

                                                            1
                                                            T1552

                                                            Credentials In Files

                                                            1
                                                            T1552.001

                                                            Discovery

                                                            Peripheral Device Discovery

                                                            2
                                                            T1120

                                                            Query Registry

                                                            4
                                                            T1012

                                                            Remote System Discovery

                                                            1
                                                            T1018

                                                            System Information Discovery

                                                            5
                                                            T1082

                                                            System Network Configuration Discovery

                                                            1
                                                            T1016

                                                            Internet Connection Discovery

                                                            1
                                                            T1016.001

                                                            Lateral Movement

                                                            Collection

                                                            Data from Local System

                                                            1
                                                            T1005

                                                            Command and Control

                                                            Web Service

                                                            1
                                                            T1102

                                                            Exfiltration

                                                            Impact

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                              Filesize

                                                              471B

                                                              MD5

                                                              c11f57a10a32cfbfe1d3eceedf9fb723

                                                              SHA1

                                                              3ecad942dec46fab6204e7e5c9ed317c02597354

                                                              SHA256

                                                              df5b2289bc0e9f694918b68bf03a51e283e092b6a262821fe125d620ecf2d2f5

                                                              SHA512

                                                              2073dc57542661d7df6c8f2b4102024754898d779cd263c79ea67f37f53e3351f5d651eddba795eeeea8004508969ce7463a9574a46509767e5472e0484a5a4c

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                              Filesize

                                                              412B

                                                              MD5

                                                              525a85ed80e1b35cb3c0ad38133cd8cb

                                                              SHA1

                                                              5d8b0babdc0d1b8c9c61eee6036898e052dac590

                                                              SHA256

                                                              ddc569c296c0ba23fa4d6371afa561504b5b0309b51b6f70f48911d09549067f

                                                              SHA512

                                                              fe2acaad890faa1bb25420459218ab2f23a61e148b0277a34cdeda92ab9451045c7b6f999ee5e929f98cef1cf7f27e73b4b9e0e993e7611faa1695dcf854680c

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                              Filesize

                                                              2KB

                                                              MD5

                                                              6cf293cb4d80be23433eecf74ddb5503

                                                              SHA1

                                                              24fe4752df102c2ef492954d6b046cb5512ad408

                                                              SHA256

                                                              b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                              SHA512

                                                              0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                              Filesize

                                                              64B

                                                              MD5

                                                              d8b9a260789a22d72263ef3bb119108c

                                                              SHA1

                                                              376a9bd48726f422679f2cd65003442c0b6f6dd5

                                                              SHA256

                                                              d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

                                                              SHA512

                                                              550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                              Filesize

                                                              944B

                                                              MD5

                                                              96ff1ee586a153b4e7ce8661cabc0442

                                                              SHA1

                                                              140d4ff1840cb40601489f3826954386af612136

                                                              SHA256

                                                              0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

                                                              SHA512

                                                              3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                              Filesize

                                                              948B

                                                              MD5

                                                              985b3105d8889886d6fd953575c54e08

                                                              SHA1

                                                              0f9a041240a344d82bac0a180520e7982c15f3cd

                                                              SHA256

                                                              5178fdd457eb3eb25c8f72ed4c22c582a83de0d324db66d0446d660f226e944d

                                                              SHA512

                                                              0fd59bc4886b70aa3b7eeeaa23229b7fdc93410ca7f8452860e4a1bbda2559eaa5e4b05c3ec2d85f7d648daf3c16741f4c2c18f2dd3bae4cc4a4e57ae4f665b0

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                              Filesize

                                                              1KB

                                                              MD5

                                                              548dd08570d121a65e82abb7171cae1c

                                                              SHA1

                                                              1a1b5084b3a78f3acd0d811cc79dbcac121217ab

                                                              SHA256

                                                              cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc

                                                              SHA512

                                                              37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                              Filesize

                                                              1KB

                                                              MD5

                                                              23272afe282560b0a5abad03e415e79b

                                                              SHA1

                                                              d24997643237343f0db0d9ab70e445450c70c795

                                                              SHA256

                                                              b3e29a57ee8c2da3dd7df14e6fd34632246e41950f3efd9ce9d35f1797ece1c9

                                                              SHA512

                                                              bc013bbd6083ef858570cdcdc89f761177f298cc394a0acfc553b2decc61e056459a539037ed67af13c2c4851e20d8df92a1c23d3d0b818a2e585506f28053c4

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                              Filesize

                                                              2KB

                                                              MD5

                                                              ea43046457c6d8aedb5a401a10adfb5e

                                                              SHA1

                                                              dd2342f1253214eaa3e87304a657875e638fac05

                                                              SHA256

                                                              19299f17ef7c5a2b308a14454ba8f7c131d85cb85e111583346abba7d228d33d

                                                              SHA512

                                                              5eca186a06b42d0ddd34e38f535e58d47d4856b3e80d7bb1cafe718dbfe8abec86fe7c12ed314ed01b2f026e2132084e207d4553b88fd72998fbf9d57f9f12bd

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2CFNWDLC\microsoft.windows[1].xml
                                                              Filesize

                                                              97B

                                                              MD5

                                                              539db492f33fccee9be530dd0bf34a46

                                                              SHA1

                                                              650b2a3583d6c9499b4ed73e9a5dca37f342a50e

                                                              SHA256

                                                              f6d425aad05b46e77b53e5737c85f4ceab6531e773ea87eb985754be5ec19999

                                                              SHA512

                                                              9328f2fa286b4a9ca6ae57ddd9fca0b1140e5f68a5e143fd8ae6ea212a1af5d7b6b2289c324fa9480ca8d2e6d3b0cf7115611a56a3a161c5ad2f988f6ae62a0a

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sqqpl2tl.l0d.ps1
                                                              Filesize

                                                              60B

                                                              MD5

                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                              SHA1

                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                              SHA256

                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                              SHA512

                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Temp\tmpB84F.tmp.bat
                                                              Filesize

                                                              226B

                                                              MD5

                                                              16a163cd5bdee93255e40b1d4529a5a8

                                                              SHA1

                                                              149abf31fabc839fb439d23523c879e58f7fb940

                                                              SHA256

                                                              e9ea79f0c56e1fcdbf1aaf9582a725bda31a3e701d7336849b9a4d377f933342

                                                              SHA512

                                                              f557382d3c82754cbf0ad7bf080b55d8e42ace0672ae81adb85a84d8d2218505e86d7838dc1a200817e7d068fa0d8cabfdecffbe339443b8c580b67bc2d5b9c0

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\lt13ez4m.pml.exe
                                                              Filesize

                                                              231KB

                                                              MD5

                                                              707b653740b6b46bf71e8d4ccd35ba63

                                                              SHA1

                                                              df34d2d312a4d7e0df8429e37b45cd6e917fafe3

                                                              SHA256

                                                              1bb99142d9821a67b1a1f90e947ad0d01840bdd2a6bf724bc8fa5c97b4e72076

                                                              SHA512

                                                              62d25457ade084eddc5c4895bce6b2aa486bca2c4e8cfff2f00bcd61014ef70b1c8965aa7d50b0454eaccab82f3ba800f4c1dc4418113a6d0dc9af696b084ff7

                                                              Download Submit

                                                            • C:\Windows\xdwd.dll
                                                              Filesize

                                                              136KB

                                                              MD5

                                                              16e5a492c9c6ae34c59683be9c51fa31

                                                              SHA1

                                                              97031b41f5c56f371c28ae0d62a2df7d585adaba

                                                              SHA256

                                                              35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

                                                              SHA512

                                                              20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

                                                              Download Submit

                                                            • memory/388-1954-0x0000000002D10000-0x0000000002D11000-memory.dmp

                                                              Filesize

                                                              4KB

                                                              Download

                                                            • memory/916-1402-0x0000000004480000-0x0000000004481000-memory.dmp

                                                              Filesize

                                                              4KB

                                                              Download

                                                            • memory/1044-1110-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                              Download

                                                            • memory/1416-1261-0x000001B8EA8A0000-0x000001B8EA8C0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/1416-1270-0x000001B8EA860000-0x000001B8EA880000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/1416-1282-0x000001B8EAE80000-0x000001B8EAEA0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/1416-1256-0x000001B8E9740000-0x000001B8E9840000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/1416-1257-0x000001B8E9740000-0x000001B8E9840000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/1452-809-0x0000000004030000-0x0000000004031000-memory.dmp

                                                              Filesize

                                                              4KB

                                                              Download

                                                            • memory/1560-1519-0x0000000001130000-0x0000000001131000-memory.dmp

                                                              Filesize

                                                              4KB

                                                              Download

                                                            • memory/2244-135-0x0000000002870000-0x000000000287C000-memory.dmp

                                                              Filesize

                                                              48KB

                                                              Download

                                                            • memory/2244-2-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

                                                              Filesize

                                                              2.0MB

                                                              Download

                                                            • memory/2244-38-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

                                                              Filesize

                                                              2.0MB

                                                              Download

                                                            • memory/2244-134-0x000000001DE50000-0x000000001DEC6000-memory.dmp

                                                              Filesize

                                                              472KB

                                                              Download

                                                            • memory/2244-0-0x00000000006C0000-0x0000000000734000-memory.dmp

                                                              Filesize

                                                              464KB

                                                              Download

                                                            • memory/2244-794-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

                                                              Filesize

                                                              2.0MB

                                                              Download

                                                            • memory/2244-136-0x00000000028D0000-0x00000000028EE000-memory.dmp

                                                              Filesize

                                                              120KB

                                                              Download

                                                            • memory/2244-1-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

                                                              Filesize

                                                              2.0MB

                                                              Download

                                                            • memory/2244-137-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

                                                              Filesize

                                                              2.0MB

                                                              Download

                                                            • memory/2244-440-0x0000000000EB0000-0x0000000000EBC000-memory.dmp

                                                              Filesize

                                                              48KB

                                                              Download

                                                            • memory/2296-1682-0x000001A8B2660000-0x000001A8B2680000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/2296-1706-0x000001A8B2C80000-0x000001A8B2CA0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/2296-1672-0x000001A8B1740000-0x000001A8B1840000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/2296-1675-0x000001A8B26A0000-0x000001A8B26C0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/2296-1671-0x000001A8B1740000-0x000001A8B1840000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/2324-450-0x0000017475F00000-0x0000017475F22000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/3056-1422-0x00000169127D0000-0x00000169127F0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/3056-1403-0x0000016911900000-0x0000016911A00000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/3056-1404-0x0000016911900000-0x0000016911A00000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/3056-1440-0x0000016912DE0000-0x0000016912E00000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/3056-1408-0x0000016912A20000-0x0000016912A40000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/3324-1002-0x000001D030780000-0x000001D0307A0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/3324-979-0x000001D030370000-0x000001D030390000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/3324-965-0x000001D02F250000-0x000001D02F350000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/3324-966-0x000001D02F250000-0x000001D02F350000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/3324-970-0x000001D0303B0000-0x000001D0303D0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/3324-967-0x000001D02F250000-0x000001D02F350000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/3536-1254-0x0000000004B70000-0x0000000004B71000-memory.dmp

                                                              Filesize

                                                              4KB

                                                              Download

                                                            • memory/3688-565-0x000002E26B970000-0x000002E26B982000-memory.dmp

                                                              Filesize

                                                              72KB

                                                              Download

                                                            • memory/3688-460-0x000002E251230000-0x000002E251270000-memory.dmp

                                                              Filesize

                                                              256KB

                                                              Download

                                                            • memory/3688-523-0x000002E26BA10000-0x000002E26BA60000-memory.dmp

                                                              Filesize

                                                              320KB

                                                              Download

                                                            • memory/3688-564-0x000002E26B920000-0x000002E26B92A000-memory.dmp

                                                              Filesize

                                                              40KB

                                                              Download

                                                            • memory/3736-1521-0x000001C74A560000-0x000001C74A660000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/3736-1539-0x000001C74B480000-0x000001C74B4A0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/3736-1550-0x000001C74BAA0000-0x000001C74BAC0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/3736-1526-0x000001C74B4C0000-0x000001C74B4E0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/3736-1522-0x000001C74A560000-0x000001C74A660000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/4136-815-0x000002A4E58C0000-0x000002A4E58E0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/4136-828-0x000002A4E5880000-0x000002A4E58A0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/4136-834-0x000002A4E5C90000-0x000002A4E5CB0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/4136-810-0x000002A4E4900000-0x000002A4E4A00000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/4136-811-0x000002A4E4900000-0x000002A4E4A00000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/4260-1955-0x0000018AD4020000-0x0000018AD4120000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/4260-1990-0x0000018AD5550000-0x0000018AD5570000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/4260-1957-0x0000018AD4020000-0x0000018AD4120000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/4260-1972-0x0000018AD5140000-0x0000018AD5160000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/4260-1960-0x0000018AD5180000-0x0000018AD51A0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/4260-1956-0x0000018AD4020000-0x0000018AD4120000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/4380-964-0x0000000004120000-0x0000000004121000-memory.dmp

                                                              Filesize

                                                              4KB

                                                              Download

                                                            • memory/4384-1668-0x00000000046D0000-0x00000000046D1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                              Download

                                                            • memory/4496-1815-0x0000000004770000-0x0000000004771000-memory.dmp

                                                              Filesize

                                                              4KB

                                                              Download

                                                            • memory/4600-1822-0x000002241F3E0000-0x000002241F400000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/4600-1833-0x000002241F3A0000-0x000002241F3C0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/4600-1853-0x000002241FBC0000-0x000002241FBE0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/4600-1817-0x000002241E500000-0x000002241E600000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/4920-1112-0x000001F5B0D00000-0x000001F5B0E00000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download

                                                            • memory/4920-1126-0x000001F5B1F90000-0x000001F5B1FB0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/4920-1142-0x000001F5B23A0000-0x000001F5B23C0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/4920-1116-0x000001F5B1FD0000-0x000001F5B1FF0000-memory.dmp

                                                              Filesize

                                                              128KB

                                                              Download

                                                            • memory/4920-1113-0x000001F5B0D00000-0x000001F5B0E00000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                              Download