Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

f3f14d9e9d...18.exe

windows7-x64

10

f3f14d9e9d...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    87s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/12/2024, 12:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f3f14d9e9d00cc5042719271483a5d87_JaffaCakes118.exe

  • Size

    283KB

  • MD5

    f3f14d9e9d00cc5042719271483a5d87

  • SHA1

    46b2dcb37ba8834f222e853b141ecc00984f7882

  • SHA256

    eaafd44c71f155d0226c4a7ac2ac26eda5ef205c92422cde9136aba2d5088127

  • SHA512

    6bf059142b9d9debd9f64fe63b74695df02344de602c3066325d0acee97e1f35c7d8ee65a99644218e9b2fdd34d58a9721ffc30831c70f0d1aed9e5ab599c851

  • SSDEEP

    6144:YFB4TgURnE22PeSNJCBbYmBxFgx7W6zbls/MOrMznAAuBexFv2F:YF4ztdOeSNsU4/gxtB87AsAuInv

Score
10/10
cycbotponybackdoorcredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 6 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 12 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\f3f14d9e9d00cc5042719271483a5d87_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f3f14d9e9d00cc5042719271483a5d87_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3432
    • C:\Users\Admin\AppData\Local\Temp\f3f14d9e9d00cc5042719271483a5d87_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\f3f14d9e9d00cc5042719271483a5d87_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\C2676\DD159.exe%C:\Users\Admin\AppData\Roaming\C2676
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1664
    • C:\Program Files (x86)\LP\599C\9EE.tmp
      "C:\Program Files (x86)\LP\599C\9EE.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3504
    • C:\Users\Admin\AppData\Local\Temp\f3f14d9e9d00cc5042719271483a5d87_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\f3f14d9e9d00cc5042719271483a5d87_JaffaCakes118.exe startC:\Program Files (x86)\76266\lvvm.exe%C:\Program Files (x86)\76266
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3592
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1736
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3044
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1836
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:868
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1720
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4928
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:2788
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4920
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3752
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:448
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1208
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3740
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1368
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1220
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4820
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3988
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4024
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:432
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:732
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4064
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4520
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1500
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1760
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1548
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1176
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4408
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2144
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5072
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4084
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1068
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3524
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3316
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:3288
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4284
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
      PID:2976
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:1500
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:2336
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:5024
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:836
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:4236
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:3580
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:4128
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:3856
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:3312
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:4228
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:4740
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:2752
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:1484
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:4444
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:912
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:2904
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:3240
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:2976
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:3124
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:4760
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:2516
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:1268
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:4488
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:4776
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:4128
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:1900
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:2068
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3760
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:3624
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:2452
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:4436
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:1760
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:3080
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:4072
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:4012
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:2704

                                                                            Network

                                                                            MITRE ATT&CK Enterprise v15

                                                                            Reconnaissance

                                                                            Resource Development

                                                                            Initial Access

                                                                            Execution

                                                                            Persistence

                                                                            Boot or Logon Autostart Execution

                                                                            2
                                                                            T1547

                                                                            Active Setup

                                                                            1
                                                                            T1547.014

                                                                            Registry Run Keys / Startup Folder

                                                                            1
                                                                            T1547.001

                                                                            Create or Modify System Process

                                                                            1
                                                                            T1543

                                                                            Windows Service

                                                                            1
                                                                            T1543.003

                                                                            Privilege Escalation

                                                                            Boot or Logon Autostart Execution

                                                                            2
                                                                            T1547

                                                                            Active Setup

                                                                            1
                                                                            T1547.014

                                                                            Registry Run Keys / Startup Folder

                                                                            1
                                                                            T1547.001

                                                                            Create or Modify System Process

                                                                            1
                                                                            T1543

                                                                            Windows Service

                                                                            1
                                                                            T1543.003

                                                                            Defense Evasion

                                                                            Modify Registry

                                                                            5
                                                                            T1112

                                                                            Credential Access

                                                                            Credentials from Password Stores

                                                                            1
                                                                            T1555

                                                                            Credentials from Web Browsers

                                                                            1
                                                                            T1555.003

                                                                            Unsecured Credentials

                                                                            3
                                                                            T1552

                                                                            Credentials In Files

                                                                            3
                                                                            T1552.001

                                                                            Discovery

                                                                            Peripheral Device Discovery

                                                                            2
                                                                            T1120

                                                                            Query Registry

                                                                            4
                                                                            T1012

                                                                            System Information Discovery

                                                                            2
                                                                            T1082

                                                                            System Location Discovery

                                                                            1
                                                                            T1614

                                                                            System Language Discovery

                                                                            1
                                                                            T1614.001

                                                                            Lateral Movement

                                                                            Collection

                                                                            Data from Local System

                                                                            2
                                                                            T1005

                                                                            Command and Control

                                                                            Exfiltration

                                                                            Impact

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            • C:\Program Files (x86)\LP\599C\9EE.tmp
                                                                              Filesize

                                                                              100KB

                                                                              MD5

                                                                              8659e2fdb286421874e997e5b1d56ae4

                                                                              SHA1

                                                                              e3b46183011a317dd80baf92ff9ef1b2da53cc05

                                                                              SHA256

                                                                              80ceedded02c13a9c4ade2d2242b2bb295bc122b5c7c0f6b3332b0f4fceae2b8

                                                                              SHA512

                                                                              ae12fd737c0a6f765ebe7a6e312230220e5fb79d42c1478a6f00edf5e67b6dec201aee90d3082b7817726c6501c7c94ce4a8eab72b2a00547bfdc382bbf2a8dc

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                              Filesize

                                                                              471B

                                                                              MD5

                                                                              bb71b013e563b7ae869761fe2b37c4e5

                                                                              SHA1

                                                                              f8e1fc825c466058acc909f5c4f1ffc640b87779

                                                                              SHA256

                                                                              114eb2409b821e694df21047f77fb8b36d212d2c4766ac8abf6814d6d594a274

                                                                              SHA512

                                                                              7bbc40233ccd7f4ac97eb1646001eca79fbad892f45de131047e8a1a8c07196dc6ee1eb11aab56f87f29c40c24273ec63db132260cacdd83546709bf0ce5d3ab

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                              Filesize

                                                                              412B

                                                                              MD5

                                                                              bf206dd5d2a4fc5cfd8d0432568f2abf

                                                                              SHA1

                                                                              e5ae4345dd97eb6e664918ce1615a973ce1dca24

                                                                              SHA256

                                                                              759ed92521bc2950234f0affbfe78bbb4ef70472d4e50139d0efa63597f63643

                                                                              SHA512

                                                                              fc0f5473ebd8f4d2f77f0abd449b7534a98ff687265fb5ac7a9f075fdd58a5eb4a699882a48c8eae2b387d603261d8cca97e19d8d5ab1b8db8c78158cdbbdeb9

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              7a48cc16a42c091406c5f06b830c2f5c

                                                                              SHA1

                                                                              0edba0297a75f1441eab329a6acd18223490a7bc

                                                                              SHA256

                                                                              9a331a6a942c393a96d884eb7a3f5f8039ce2200e747afab018c1b30bef2be36

                                                                              SHA512

                                                                              6e42299d3f6f5fa894a8bdc02dfe1f1786bcc19c9d177231b555db544a28dfac1244f270bd8bfe108250a3773100bcef9e88d472e6fef02611d38598979db2e6

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
                                                                              Filesize

                                                                              36KB

                                                                              MD5

                                                                              0e2a09c8b94747fa78ec836b5711c0c0

                                                                              SHA1

                                                                              92495421ad887f27f53784c470884802797025ad

                                                                              SHA256

                                                                              0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                              SHA512

                                                                              61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
                                                                              Filesize

                                                                              36KB

                                                                              MD5

                                                                              ab0262f72142aab53d5402e6d0cb5d24

                                                                              SHA1

                                                                              eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                              SHA256

                                                                              20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                              SHA512

                                                                              bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\80AM9X7C\microsoft.windows[1].xml
                                                                              Filesize

                                                                              96B

                                                                              MD5

                                                                              c839a1973d3feaead377ea2dad131fe6

                                                                              SHA1

                                                                              252758616792b9b2f10bc460c84b1c1eba75ea04

                                                                              SHA256

                                                                              efecd8d483398a6cb569af17e66cb0ba1ca4b9c65f4a697fc7642cc007fc3ccd

                                                                              SHA512

                                                                              fee6ca3d2ae272b0f1f291e98830215f2ac138747651be78325ab7c1ba3f01f72cbfed4c886853caba45f16c59c78543a87a5f872b2c1f85bffa3a4e11bf50e1

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\C2676\6266.267
                                                                              Filesize

                                                                              600B

                                                                              MD5

                                                                              63b090773d535360618a6753c23f1f54

                                                                              SHA1

                                                                              80784929ca3c38b58319c38166408b515ec67f3a

                                                                              SHA256

                                                                              d428c4ad5c2bdc89ba8199bc2bab6e44387f4974d005dbc82665a4290a677bad

                                                                              SHA512

                                                                              6c2bdde9dde648598096ffb418dbf8e95da1fc5eb025505c247cb34e7a6a703548613e2ac492c7b3fdecf52bbb3b983f5293038195f5054c99e66bd341745501

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\C2676\6266.267
                                                                              Filesize

                                                                              897B

                                                                              MD5

                                                                              8542fb0055c0f4f4639fad41a1875e31

                                                                              SHA1

                                                                              caf6e36f74da8a5944cdde5889ef116990f6d59d

                                                                              SHA256

                                                                              0bd6d12e96251ffa923f0a0b6d726b641e0ea6027332f6b22aefa0e423518197

                                                                              SHA512

                                                                              aa1e18ae1bd4d6e5014394b6f0ab588c9b31f1f698e5282ab43f848e1422fc0e074794ec910da5271f0524a8ff3874d7f000f354505a689828141c03c513435a

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\C2676\6266.267
                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              5b3a69d0fbbdf5b72e8b1c6cb6ad08e6

                                                                              SHA1

                                                                              9a447e13c0e93e3652a81cbed8664bf7a85ce6b3

                                                                              SHA256

                                                                              2a1bf9504a031f563dd430b565ddfa917a3fcc9940b2466bb1430c731221c3bd

                                                                              SHA512

                                                                              e38712517bcce8683d812e02e3b3d5c53bcbe23550fe0d220f986b297390f8ed5be35b3eea0aab687f881f56129b4c79be691177260539678e44af11c3055a83

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\C2676\6266.267
                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              f52d3e8434f64cecef3b5d10c2ea6d87

                                                                              SHA1

                                                                              5b3a873a747474cd6ff8f645d13bc6b016111c51

                                                                              SHA256

                                                                              d330c91ca8f63f23f93e31de42d74f051ad4c6539aa5adc6ad7d5ba858d480c8

                                                                              SHA512

                                                                              03da3e38082118416b3bd49c7f0b35069c9316b668303e82a9323360ab4e52017f88cdc7728ce9af8bde9c085f3847f8266bf1abad5f615b92fe9ffb784a3914

                                                                              Download Submit

                                                                            • memory/432-904-0x0000023C2DC20000-0x0000023C2DC40000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/432-914-0x0000023C2D9D0000-0x0000023C2D9F0000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/432-899-0x000002342BB00000-0x000002342BC00000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                              Download

                                                                            • memory/432-927-0x0000023C2DFE0000-0x0000023C2E000000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/448-499-0x0000000004740000-0x0000000004741000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                              Download

                                                                            • memory/868-74-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                              Download

                                                                            • memory/1368-748-0x0000000003F50000-0x0000000003F51000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                              Download

                                                                            • memory/1548-1185-0x0000000002D50000-0x0000000002D51000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                              Download

                                                                            • memory/1664-62-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                              Filesize

                                                                              428KB

                                                                              Download

                                                                            • memory/1760-1049-0x000002B463000000-0x000002B463100000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                              Download

                                                                            • memory/1760-1054-0x000002B464160000-0x000002B464180000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/1760-1051-0x000002B463000000-0x000002B463100000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                              Download

                                                                            • memory/1760-1076-0x000002B464520000-0x000002B464540000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/1760-1064-0x000002B464120000-0x000002B464140000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/2144-1330-0x0000000004340000-0x0000000004341000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                              Download

                                                                            • memory/2788-354-0x0000000004170000-0x0000000004171000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                              Download

                                                                            • memory/3432-2-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                              Filesize

                                                                              428KB

                                                                              Download

                                                                            • memory/3432-496-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                              Filesize

                                                                              428KB

                                                                              Download

                                                                            • memory/3432-4-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                              Filesize

                                                                              416KB

                                                                              Download

                                                                            • memory/3432-1-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                              Filesize

                                                                              416KB

                                                                              Download

                                                                            • memory/3432-3-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                              Filesize

                                                                              428KB

                                                                              Download

                                                                            • memory/3432-69-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                              Filesize

                                                                              428KB

                                                                              Download

                                                                            • memory/3504-490-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                              Filesize

                                                                              112KB

                                                                              Download

                                                                            • memory/3592-469-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                              Filesize

                                                                              428KB

                                                                              Download

                                                                            • memory/3740-529-0x0000014F26E20000-0x0000014F26E40000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/3740-506-0x0000014F26E60000-0x0000014F26E80000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/3740-538-0x0000014F27220000-0x0000014F27240000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/3740-501-0x0000014F25D00000-0x0000014F25E00000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                              Download

                                                                            • memory/3740-502-0x0000014F25D00000-0x0000014F25E00000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                              Download

                                                                            • memory/3752-356-0x0000025608000000-0x0000025608100000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                              Download

                                                                            • memory/3752-383-0x0000025609530000-0x0000025609550000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/3752-357-0x0000025608000000-0x0000025608100000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                              Download

                                                                            • memory/3752-361-0x0000025609160000-0x0000025609180000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/3752-372-0x0000025609120000-0x0000025609140000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/3988-898-0x0000000004480000-0x0000000004481000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                              Download

                                                                            • memory/4084-1332-0x000001B353300000-0x000001B353400000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                              Download

                                                                            • memory/4084-1333-0x000001B353300000-0x000001B353400000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                              Download

                                                                            • memory/4084-1337-0x000001B3543B0000-0x000001B3543D0000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/4084-1346-0x000001B354370000-0x000001B354390000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/4408-1192-0x0000022344720000-0x0000022344740000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/4408-1188-0x0000022343800000-0x0000022343900000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                              Download

                                                                            • memory/4408-1214-0x0000022344D00000-0x0000022344D20000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/4408-1202-0x00000223446E0000-0x0000022344700000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/4520-1047-0x00000000040E0000-0x00000000040E1000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                              Download

                                                                            • memory/4820-764-0x0000029419260000-0x0000029419280000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/4820-750-0x0000029418000000-0x0000029418100000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                              Download

                                                                            • memory/4820-751-0x0000029418000000-0x0000029418100000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                              Download

                                                                            • memory/4820-755-0x00000294192A0000-0x00000294192C0000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/4820-776-0x0000029419670000-0x0000029419690000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/4928-98-0x000001CD3BD20000-0x000001CD3BD40000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/4928-83-0x000001CD3B910000-0x000001CD3B930000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/4928-80-0x000001CD3B950000-0x000001CD3B970000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                              Download

                                                                            • memory/4928-76-0x000001CD3A940000-0x000001CD3AA40000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                              Download