Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...a2.exe

windows7-x64

10

JaffaCakes...a2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    77s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/01/2025, 23:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_120503cfb86e67178a0fb8da058b80a2.exe

  • Size

    279KB

  • MD5

    120503cfb86e67178a0fb8da058b80a2

  • SHA1

    9b84b60705a05fe827041630af64f0a51ce85c15

  • SHA256

    6c1f54e420597522b0723224588f10b104f1b5449e890eee924d8bcb314622f0

  • SHA512

    f29177b57972f0b947a5d65743a6e53346bca9c69e0a89bcdf015db29b98b9664de914f54dbf203c24b9f4928ff7ed1f0d9f1f1dd364d363596dab43ee09364b

  • SSDEEP

    6144:IRsxhYWbtfYhL2axRmToBIkBLsdreg2Fv12yGUD14F3i4l:IidbtfYZlNBIkJsdb2Fv1hG41ei4l

Score
10/10
cycbotponybackdoorcredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 6 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 13 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_120503cfb86e67178a0fb8da058b80a2.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_120503cfb86e67178a0fb8da058b80a2.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4088
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_120503cfb86e67178a0fb8da058b80a2.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_120503cfb86e67178a0fb8da058b80a2.exe startC:\Users\Admin\AppData\Roaming\ADAA9\447F0.exe%C:\Users\Admin\AppData\Roaming\ADAA9
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3808
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_120503cfb86e67178a0fb8da058b80a2.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_120503cfb86e67178a0fb8da058b80a2.exe startC:\Program Files (x86)\A979C\lvvm.exe%C:\Program Files (x86)\A979C
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4884
    • C:\Program Files (x86)\LP\F0BA\F56C.tmp
      "C:\Program Files (x86)\LP\F0BA\F56C.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2564
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1572
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2272
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3484
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4452
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4364
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1340
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4716
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4828
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:3976
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1996
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4064
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3484
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:316
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:4252
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4040
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1400
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:1424
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:548
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4584
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2872
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3408
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4188
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3688
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:724
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4584
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4728
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3704
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4828
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1520
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2208
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:632
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3840
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1808
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1528
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:648
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:4336
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:3956
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:4124
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:2804
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:2496
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4904
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:1104
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:840
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:2172
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3672
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:3740
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:4612
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:1036
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:4480
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:3840
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:3316
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:4768
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:2740
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:2212
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:4196
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:1404
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:2052
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:3288
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:3728
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:4228
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:4912
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:2952
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:4836
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:5008
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:5036
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:4872
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:4348
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:5008
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:944
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:1128
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:708
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:548
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:3304
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:1128
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:3316
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:1012
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:3104
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:4248
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:4716

                                                                                          Network

                                                                                          MITRE ATT&CK Enterprise v15

                                                                                          Reconnaissance

                                                                                          Resource Development

                                                                                          Initial Access

                                                                                          Execution

                                                                                          Persistence

                                                                                          Boot or Logon Autostart Execution

                                                                                          2
                                                                                          T1547

                                                                                          Active Setup

                                                                                          1
                                                                                          T1547.014

                                                                                          Registry Run Keys / Startup Folder

                                                                                          1
                                                                                          T1547.001

                                                                                          Create or Modify System Process

                                                                                          1
                                                                                          T1543

                                                                                          Windows Service

                                                                                          1
                                                                                          T1543.003

                                                                                          Privilege Escalation

                                                                                          Boot or Logon Autostart Execution

                                                                                          2
                                                                                          T1547

                                                                                          Active Setup

                                                                                          1
                                                                                          T1547.014

                                                                                          Registry Run Keys / Startup Folder

                                                                                          1
                                                                                          T1547.001

                                                                                          Create or Modify System Process

                                                                                          1
                                                                                          T1543

                                                                                          Windows Service

                                                                                          1
                                                                                          T1543.003

                                                                                          Defense Evasion

                                                                                          Modify Registry

                                                                                          5
                                                                                          T1112

                                                                                          Credential Access

                                                                                          Credentials from Password Stores

                                                                                          1
                                                                                          T1555

                                                                                          Credentials from Web Browsers

                                                                                          1
                                                                                          T1555.003

                                                                                          Unsecured Credentials

                                                                                          3
                                                                                          T1552

                                                                                          Credentials In Files

                                                                                          3
                                                                                          T1552.001

                                                                                          Discovery

                                                                                          Peripheral Device Discovery

                                                                                          2
                                                                                          T1120

                                                                                          Query Registry

                                                                                          4
                                                                                          T1012

                                                                                          System Information Discovery

                                                                                          2
                                                                                          T1082

                                                                                          System Location Discovery

                                                                                          1
                                                                                          T1614

                                                                                          System Language Discovery

                                                                                          1
                                                                                          T1614.001

                                                                                          Lateral Movement

                                                                                          Collection

                                                                                          Data from Local System

                                                                                          2
                                                                                          T1005

                                                                                          Command and Control

                                                                                          Exfiltration

                                                                                          Impact

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          • C:\Program Files (x86)\LP\F0BA\F56C.tmp
                                                                                            Filesize

                                                                                            100KB

                                                                                            MD5

                                                                                            bfc2cd6d0b7e0440413c1fa500d0bd78

                                                                                            SHA1

                                                                                            6b269d638bb04bb7b94b7572f3f93db0d5130e8d

                                                                                            SHA256

                                                                                            96f7ce07e7a6eb6e73c61dcb55efe9ca941795a1f12d2c001bb87783874697f2

                                                                                            SHA512

                                                                                            54c1fdca1c35c79f9147a3ec65c271f99b3d9a5d8c5e4f5d04fd5989dc81f05685a6eae691e28148585de1e7028469512a52ff2b7b32d45687fe9d393a1b0016

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                            Filesize

                                                                                            471B

                                                                                            MD5

                                                                                            f9128bb8d29036190effdd498b081442

                                                                                            SHA1

                                                                                            639c03179c72c8ece261f2c30267cd35149dc71a

                                                                                            SHA256

                                                                                            1b0d02ad59cfd790431bbed74cafb68aee2ca8918e6d00d1282c208ba327c4aa

                                                                                            SHA512

                                                                                            81378f6720867ec67ee5d4f5120b16327d8e707ec908b890bcddd2319b3abc35848098f828f8e5db4028f997ffa17ab764608e61a9acaacbb837a92e9587ec8b

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                            Filesize

                                                                                            412B

                                                                                            MD5

                                                                                            c487ba6a56edac48e977349043cdde04

                                                                                            SHA1

                                                                                            2293a0e00a5b1762d0567308083f883f05da9a2f

                                                                                            SHA256

                                                                                            22d8de3fbea57cb4467f032a4fb69f5bd35c2ff932cb0ad759854176c7e87d63

                                                                                            SHA512

                                                                                            50f9c3647719f8d1239c45ddebc1b6bcf690d3a50e1a2011bf8e44a0553121512f8b3ec30f7f99dd4537c31d843f0300ea2619a538d115831c54a7af1a93949d

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                            Filesize

                                                                                            2KB

                                                                                            MD5

                                                                                            f0a4926fdcde23f4ca8a902c2cd8d55c

                                                                                            SHA1

                                                                                            8a50f4620c493f2b1a9b364058427bdff3affab8

                                                                                            SHA256

                                                                                            379d66f8bed550854fee03550eb8a739c0dacfdb4c7777b135833cd3b99ebc05

                                                                                            SHA512

                                                                                            ea15146f21011371b3ce2828b9623777af2602bb681bc49c74d96421518589a9c24494e884f2595dc44250f04a25029b94e78dfe9f3f0aab712bd76acbe28159

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\80AM9X7C\microsoft.windows[1].xml
                                                                                            Filesize

                                                                                            96B

                                                                                            MD5

                                                                                            c839a1973d3feaead377ea2dad131fe6

                                                                                            SHA1

                                                                                            252758616792b9b2f10bc460c84b1c1eba75ea04

                                                                                            SHA256

                                                                                            efecd8d483398a6cb569af17e66cb0ba1ca4b9c65f4a697fc7642cc007fc3ccd

                                                                                            SHA512

                                                                                            fee6ca3d2ae272b0f1f291e98830215f2ac138747651be78325ab7c1ba3f01f72cbfed4c886853caba45f16c59c78543a87a5f872b2c1f85bffa3a4e11bf50e1

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\ADAA9\979C.DAA
                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            30d5b5282907de070ce83a96cb3ba12c

                                                                                            SHA1

                                                                                            13c7ac3080036d33fd1b5202d5b5daa75b7ade8f

                                                                                            SHA256

                                                                                            db151ca9ec3e2124a9f4b423e2c3c8c3a1c4b6f2d168c89e3af67315c753d0aa

                                                                                            SHA512

                                                                                            ac8c4146cf1073427f4c2b2d761530e6758ab86d64179172a1f8f76293468ff5f6fc56fd0de414dbf8dee3c6844c2487f6e6870451dea50da8f0211091963885

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\ADAA9\979C.DAA
                                                                                            Filesize

                                                                                            996B

                                                                                            MD5

                                                                                            c6d59ad053019d3c054cd6811628059f

                                                                                            SHA1

                                                                                            1cf9edd30f58f85e02761ee218e4d17babe8d702

                                                                                            SHA256

                                                                                            91fba814c94e05b89ca74d91af9d50234298a94c8db735600512912fd3009107

                                                                                            SHA512

                                                                                            359bc43087d3174954058657e35b0010858c8a704745f54aa94ee76485d6531e9ba5c3fb9ba4b82d5fcae43ffd0649d2acec0b8b5d2a8aba60419d3c2edd1cf9

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\ADAA9\979C.DAA
                                                                                            Filesize

                                                                                            600B

                                                                                            MD5

                                                                                            bc36bec6b525068726e64ac4fffbd1d3

                                                                                            SHA1

                                                                                            bcb4602b2fbb25b2f7d2662ca3a690c2f5cfcf57

                                                                                            SHA256

                                                                                            5b089cb197aa6aaac05f8ca0ed780d87d9d3c31781bc492b40369f39471f6744

                                                                                            SHA512

                                                                                            04dc32f878f4986c82249313fa94001bd100fdf37fa93ce437a6d5dc713bbe9f4967ea87cb4d9294dee89e203059de982e3203a19af3040cd31a5bc1a0b1dae0

                                                                                            Download Submit

                                                                                          • memory/632-1252-0x000002A46CDB0000-0x000002A46CDD0000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/632-1243-0x000002A46CDF0000-0x000002A46CE10000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/632-1237-0x000002A46BD00000-0x000002A46BE00000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/632-1238-0x000002A46BD00000-0x000002A46BE00000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/1340-184-0x0000000002740000-0x0000000002741000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/1400-499-0x0000025E9D500000-0x0000025E9D600000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/1400-504-0x000002669F640000-0x000002669F660000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/1400-526-0x000002669FA00000-0x000002669FA20000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/1400-515-0x000002669F600000-0x000002669F620000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/1400-501-0x0000025E9D500000-0x0000025E9D600000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/1400-500-0x0000025E9D500000-0x0000025E9D600000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/1424-649-0x0000000004640000-0x0000000004641000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/1520-1235-0x0000000004540000-0x0000000004541000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/2564-493-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                            Filesize

                                                                                            112KB

                                                                                            Download

                                                                                          • memory/2872-792-0x00000000044A0000-0x00000000044A1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/3688-937-0x0000000004960000-0x0000000004961000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/3808-14-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                            Filesize

                                                                                            428KB

                                                                                            Download

                                                                                          • memory/3808-15-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                            Filesize

                                                                                            428KB

                                                                                            Download

                                                                                          • memory/3976-343-0x0000000003FB0000-0x0000000003FB1000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/4064-345-0x0000013AD0300000-0x0000013AD0400000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4064-382-0x0000013AD17C0000-0x0000013AD17E0000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4064-350-0x0000013AD13F0000-0x0000013AD1410000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4064-347-0x0000013AD0300000-0x0000013AD0400000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4064-346-0x0000013AD0300000-0x0000013AD0400000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4064-355-0x0000013AD13B0000-0x0000013AD13D0000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4088-13-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                            Filesize

                                                                                            416KB

                                                                                            Download

                                                                                          • memory/4088-495-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                            Filesize

                                                                                            428KB

                                                                                            Download

                                                                                          • memory/4088-2-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                            Filesize

                                                                                            428KB

                                                                                            Download

                                                                                          • memory/4088-11-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                            Filesize

                                                                                            428KB

                                                                                            Download

                                                                                          • memory/4088-79-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                            Filesize

                                                                                            428KB

                                                                                            Download

                                                                                          • memory/4088-1-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                            Filesize

                                                                                            416KB

                                                                                            Download

                                                                                          • memory/4188-821-0x0000023312620000-0x0000023312640000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4188-794-0x0000023311100000-0x0000023311200000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4188-810-0x0000023312220000-0x0000023312240000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4188-800-0x0000023312260000-0x0000023312280000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4252-497-0x0000000002E30000-0x0000000002E31000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/4584-940-0x0000025D84700000-0x0000025D84800000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4584-651-0x0000016E98300000-0x0000016E98400000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4584-672-0x0000016E995B0000-0x0000016E995D0000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4584-653-0x0000016E98300000-0x0000016E98400000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4584-684-0x0000016E999C0000-0x0000016E999E0000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4584-652-0x0000016E98300000-0x0000016E98400000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4584-939-0x0000025D84700000-0x0000025D84800000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4584-944-0x0000025D856E0000-0x0000025D85700000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4584-657-0x0000016E995F0000-0x0000016E99610000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4584-956-0x0000025D856A0000-0x0000025D856C0000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4584-976-0x0000025D85AB0000-0x0000025D85AD0000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4728-1083-0x0000000004870000-0x0000000004871000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                            Download

                                                                                          • memory/4828-1087-0x000002429CB00000-0x000002429CC00000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4828-1090-0x000002429DC40000-0x000002429DC60000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4828-1100-0x000002429DC00000-0x000002429DC20000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4828-1086-0x000002429CB00000-0x000002429CC00000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4828-1085-0x000002429CB00000-0x000002429CC00000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4828-1112-0x000002429E010000-0x000002429E030000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4828-207-0x0000022EC8F60000-0x0000022EC8F80000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4828-221-0x0000022EC9570000-0x0000022EC9590000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4828-185-0x0000022EC8170000-0x0000022EC8270000-memory.dmp

                                                                                            Filesize

                                                                                            1024KB

                                                                                            Download

                                                                                          • memory/4828-190-0x0000022EC8FA0000-0x0000022EC8FC0000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/4884-81-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                            Filesize

                                                                                            428KB

                                                                                            Download