Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...5a.exe

windows7-x64

10

JaffaCakes...5a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    89s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/01/2025, 19:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_6d3ad9b3fdd260b02d79050ad5bebd5a.exe

  • Size

    287KB

  • MD5

    6d3ad9b3fdd260b02d79050ad5bebd5a

  • SHA1

    6afc60dfbcc39fa186c7cc9f1e3e53492c166c0b

  • SHA256

    6d0c40c750805bdc8dc986e420507450ab6bf1ff1f27a27950f48decac313be2

  • SHA512

    468396b57f4b00c51b9803bbfaa26013e0aea3a17cd1cf137904f40f98535c9884b6fc8efe0757d70d4b4f60212509ea7517e064e99d2c4a886691c7c61db500

  • SSDEEP

    6144:8BsR4G+igETnf9+dXvqU6KMT+qjFFSswI+pn63GxKkfjG+hAQnAf/qqZ+:8B+4G7fuCU43QswIu6WVy+hD2iqZ+

Score
10/10
cycbotponybackdoorcredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 7 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 15 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 28 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 26 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d3ad9b3fdd260b02d79050ad5bebd5a.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d3ad9b3fdd260b02d79050ad5bebd5a.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3076
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d3ad9b3fdd260b02d79050ad5bebd5a.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d3ad9b3fdd260b02d79050ad5bebd5a.exe startC:\Users\Admin\AppData\Roaming\751BE\73050.exe%C:\Users\Admin\AppData\Roaming\751BE
      2⤵
      • System Location Discovery: System Language Discovery
      PID:740
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d3ad9b3fdd260b02d79050ad5bebd5a.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d3ad9b3fdd260b02d79050ad5bebd5a.exe startC:\Program Files (x86)\BEA2F\lvvm.exe%C:\Program Files (x86)\BEA2F
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3876
    • C:\Program Files (x86)\LP\5047\1E80.tmp
      "C:\Program Files (x86)\LP\5047\1E80.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4284
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4292
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4384
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4840
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3700
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2392
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:396
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3792
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3544
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:2196
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3868
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3596
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:3184
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1392
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:4104
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4312
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3180
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:4984
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:768
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1056
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4464
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3680
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:832
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1312
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4896
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2456
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4340
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:2748
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4764
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3924
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:856
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4204
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:812
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3920
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:228
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1068
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:3928
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2184
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4280
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3576
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:832
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:1376
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    PID:2800
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:608
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:2312
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:3752
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:4352
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:4184
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4884
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:2912
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:652
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:4400
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3520
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:3492
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:2804
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:4392
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:812
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:116
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:3876
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:4908
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:1224
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:3596
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:4320
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:3044
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:2924
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:400
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:2960
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:4768
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:4300
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:972
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:4796
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3920
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:3588
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:264
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:4428
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:744
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:4252
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:812
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:4216

                                                                          Network

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Reconnaissance

                                                                          Resource Development

                                                                          Initial Access

                                                                          Execution

                                                                          Persistence

                                                                          Boot or Logon Autostart Execution

                                                                          2
                                                                          T1547

                                                                          Active Setup

                                                                          1
                                                                          T1547.014

                                                                          Registry Run Keys / Startup Folder

                                                                          1
                                                                          T1547.001

                                                                          Create or Modify System Process

                                                                          1
                                                                          T1543

                                                                          Windows Service

                                                                          1
                                                                          T1543.003

                                                                          Privilege Escalation

                                                                          Boot or Logon Autostart Execution

                                                                          2
                                                                          T1547

                                                                          Active Setup

                                                                          1
                                                                          T1547.014

                                                                          Registry Run Keys / Startup Folder

                                                                          1
                                                                          T1547.001

                                                                          Create or Modify System Process

                                                                          1
                                                                          T1543

                                                                          Windows Service

                                                                          1
                                                                          T1543.003

                                                                          Defense Evasion

                                                                          Modify Registry

                                                                          5
                                                                          T1112

                                                                          Credential Access

                                                                          Credentials from Password Stores

                                                                          1
                                                                          T1555

                                                                          Credentials from Web Browsers

                                                                          1
                                                                          T1555.003

                                                                          Unsecured Credentials

                                                                          3
                                                                          T1552

                                                                          Credentials In Files

                                                                          3
                                                                          T1552.001

                                                                          Discovery

                                                                          Peripheral Device Discovery

                                                                          2
                                                                          T1120

                                                                          Query Registry

                                                                          4
                                                                          T1012

                                                                          System Information Discovery

                                                                          2
                                                                          T1082

                                                                          System Location Discovery

                                                                          1
                                                                          T1614

                                                                          System Language Discovery

                                                                          1
                                                                          T1614.001

                                                                          Lateral Movement

                                                                          Collection

                                                                          Data from Local System

                                                                          2
                                                                          T1005

                                                                          Command and Control

                                                                          Exfiltration

                                                                          Impact

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          • C:\Program Files (x86)\LP\5047\1E80.tmp
                                                                            Filesize

                                                                            101KB

                                                                            MD5

                                                                            8ddb300fe82a1e8ab0b0c9b704725316

                                                                            SHA1

                                                                            899ef3abfa492136996ccffd0958e0c607817835

                                                                            SHA256

                                                                            86725431a4d0a9b52b5be71853baac7bc228b5ce92443e758a376ef7e7cbac5f

                                                                            SHA512

                                                                            3a13663e34a65a6f255c973aeb4c2534adc386135d401b7274fd958c753e29116dc85f6736481593d8cdf7459dc65aa926de7d5b3a67db983730e36db146b321

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                            Filesize

                                                                            471B

                                                                            MD5

                                                                            8b2c7086fb4ac5566a019ce59ae92a2a

                                                                            SHA1

                                                                            ec6a96151fc2e25f4fcbfe7279d246c3651a6249

                                                                            SHA256

                                                                            46731e4108a4de7bc1fd51ad9eeae152ea690dcc27d0ada40ea66e29f4280189

                                                                            SHA512

                                                                            0d9d7985b345bfe8c0bba6e9cf984aa72e32853d4f3dd81063cfcd654ba3d1cb3790b57ad5efdfab779dee7b6b6589dde15dd2d3be2361d7c8ea4d327ea536e0

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                            Filesize

                                                                            412B

                                                                            MD5

                                                                            88506182e852a7b7ff734e5603993c9a

                                                                            SHA1

                                                                            25d4da1d701b24f3ae0dc8f57eeceb4a8c5ddd4b

                                                                            SHA256

                                                                            8d756f9226f7f1ab88270d003d7bf889c6a2fcca9d39b2195a07c3b4f30e404f

                                                                            SHA512

                                                                            b4e5665dc96b8bf872cf5f52a48bbf8b3d923c3e20bc98d4ad20aeaa6b7738b84e4342e40d64d7c18e13decc7e999a27a318ef4a78630c02533d267483f2eb0e

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            b6b4eb361ba793212559ec3a8b977f29

                                                                            SHA1

                                                                            cc087ad87fb98c2f018b93e0b7314fe76fb40cb5

                                                                            SHA256

                                                                            80471b45a333261600190c05c90503fd325923a631595d223e557486272c7234

                                                                            SHA512

                                                                            8b4f291af74300de2dbee784833bdf2d43eaf82498523bf8dfc7202cee567bd5b644a967d41b812646e9d22ae33efd829f6f9e8efe8371014cc726775b0add6f

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_help
                                                                            Filesize

                                                                            36KB

                                                                            MD5

                                                                            8aaad0f4eb7d3c65f81c6e6b496ba889

                                                                            SHA1

                                                                            231237a501b9433c292991e4ec200b25c1589050

                                                                            SHA256

                                                                            813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1

                                                                            SHA512

                                                                            1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_osk_exe
                                                                            Filesize

                                                                            36KB

                                                                            MD5

                                                                            f6a5ffe5754175d3603c3a77dcfeca6b

                                                                            SHA1

                                                                            dacd500aeef9dd69b87feae7521899040e7df1d9

                                                                            SHA256

                                                                            fab3529f4a4df98271fa2f6a7860a28fdc30215144b7eefbaf6d424a2847d035

                                                                            SHA512

                                                                            66ec46041f1fe20203cda7a4d68b61d2e5bcdd09a36ee8171efa53fe92a9e6e023c5a254a4c43c110a99749829d7b99613f8d13dfb4c42656097cb8d224a531e

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\M6JCG2RK\microsoft.windows[1].xml
                                                                            Filesize

                                                                            96B

                                                                            MD5

                                                                            732a32ad072ef786d816a4f85b1b6bea

                                                                            SHA1

                                                                            fe1945717c160ac3266f291564a003c044d409b0

                                                                            SHA256

                                                                            7dd2262373fcd6ebe2ed2c6e66242c85b1434c3fe23ca92ba41ae328ce8b941e

                                                                            SHA512

                                                                            55b57d5bf942f20a3557f20adeebb4c01cde4aec9d7a4fa8bfe6281fe0981773d8ce637fdbd1dc64f25abe72d75fad2a6538fadc86483ede9fdc5b59c0d36b79

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\751BE\EA2F.51B
                                                                            Filesize

                                                                            996B

                                                                            MD5

                                                                            b360363ac8f3064c76d5716d66ae3fa7

                                                                            SHA1

                                                                            8c68e7b0a1dad5410e54cc953fd2744bcbe471a7

                                                                            SHA256

                                                                            a0ccd89021408ff90aff284a68e33feca63ff04cbb176944b8f3fc757d9f2154

                                                                            SHA512

                                                                            fecc2f81c9bb71b43ac1c1aee47d478a83224bdf36ddd385d9f2f36fc09e3a8aa651b209b748e715a625bc390e28e79b6b1346c81a5d22c4f606cfb418e9ad12

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\751BE\EA2F.51B
                                                                            Filesize

                                                                            600B

                                                                            MD5

                                                                            98dc04aa8fa8de13045ffe671a9ed5e6

                                                                            SHA1

                                                                            ea3719dbda384eefee5d3d46f6d55cffc38f9e67

                                                                            SHA256

                                                                            d761a95771512b75075e6fd4a4e9e99acc1b8bbf559a898184d7d8f1f15567d6

                                                                            SHA512

                                                                            c115b7b04db2477f3fd92d4a52198f7da0db933641cd64fe3677fa22076fe7d4f8406e21e340707c35c801cb0ac59e02d9aa17da6ee7842cd9f89ab8b372fac2

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\751BE\EA2F.51B
                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            823adb63ac560ad9e16d1ea17f9267c2

                                                                            SHA1

                                                                            e168f1cdf20a04c6e594d675b5ec94825af6039d

                                                                            SHA256

                                                                            f149504080617093ae28f515fea8f8ef3ea4da9f8feb5a715ceaf99ba690dfb2

                                                                            SHA512

                                                                            89d8163c28505cfdee3228314de2c7d76e6aa933223fda7646d401bfd3242fd314a50adf8deeb5f2ac59fff8748f6ac453a2cc2ba7adbcb857e94350d59955f1

                                                                            Download Submit

                                                                          • memory/396-326-0x0000000002F20000-0x0000000002F21000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/740-14-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                            Filesize

                                                                            428KB

                                                                            Download

                                                                          • memory/768-935-0x0000000004490000-0x0000000004491000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/812-1534-0x00000217142B0000-0x00000217142D0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/812-1557-0x0000021714880000-0x00000217148A0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/812-1545-0x0000021714270000-0x0000021714290000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/856-1527-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/1068-1692-0x0000020BF4780000-0x0000020BF47A0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/1068-1679-0x0000020BF47C0000-0x0000020BF47E0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/1312-1100-0x00000253CFC40000-0x00000253CFC60000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/1312-1113-0x00000253D0050000-0x00000253D0070000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/1312-1090-0x00000253CFC80000-0x00000253CFCA0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/2196-488-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/2748-1381-0x00000000046F0000-0x00000000046F1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/3076-1525-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                            Filesize

                                                                            428KB

                                                                            Download

                                                                          • memory/3076-2-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                            Filesize

                                                                            428KB

                                                                            Download

                                                                          • memory/3076-138-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                            Filesize

                                                                            428KB

                                                                            Download

                                                                          • memory/3076-13-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                            Filesize

                                                                            416KB

                                                                            Download

                                                                          • memory/3076-641-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                            Filesize

                                                                            428KB

                                                                            Download

                                                                          • memory/3076-11-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                            Filesize

                                                                            428KB

                                                                            Download

                                                                          • memory/3076-1-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                            Filesize

                                                                            416KB

                                                                            Download

                                                                          • memory/3184-639-0x0000000004550000-0x0000000004551000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/3544-343-0x000001D2ADD80000-0x000001D2ADDA0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3544-328-0x000001D2ACD80000-0x000001D2ACE80000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/3544-363-0x000001D2AE190000-0x000001D2AE1B0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3544-332-0x000001D2ADDC0000-0x000001D2ADDE0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3544-327-0x000001D2ACD80000-0x000001D2ACE80000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/3596-494-0x00000281A0220000-0x00000281A0240000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3596-490-0x000002819F100000-0x000002819F200000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/3596-491-0x000002819F100000-0x000002819F200000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/3596-489-0x000002819F100000-0x000002819F200000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/3596-503-0x000002819FFD0000-0x000002819FFF0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3596-515-0x00000281A05E0000-0x00000281A0600000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3680-1083-0x00000000043B0000-0x00000000043B1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/3876-142-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                            Filesize

                                                                            428KB

                                                                            Download

                                                                          • memory/3876-140-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                            Filesize

                                                                            428KB

                                                                            Download

                                                                          • memory/3920-1671-0x0000000004550000-0x0000000004551000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/3924-1384-0x0000017773000000-0x0000017773100000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/3924-1411-0x00000177744E0000-0x0000017774500000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3924-1382-0x0000017773000000-0x0000017773100000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/3924-1400-0x0000017773BC0000-0x0000017773BE0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3924-1387-0x0000017773F00000-0x0000017773F20000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3924-1383-0x0000017773000000-0x0000017773100000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/4104-679-0x0000020442970000-0x0000020442990000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4104-642-0x0000020441440000-0x0000020441540000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/4104-657-0x0000020442560000-0x0000020442580000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4104-647-0x00000204425A0000-0x00000204425C0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4284-637-0x0000000000400000-0x000000000041D000-memory.dmp

                                                                            Filesize

                                                                            116KB

                                                                            Download

                                                                          • memory/4312-782-0x00000000023F0000-0x00000000023F1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4340-1240-0x00000152832E0000-0x0000015283300000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4340-1252-0x00000152832A0000-0x00000152832C0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4340-1271-0x00000152838C0000-0x00000152838E0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4464-954-0x0000024CD5080000-0x0000024CD50A0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4464-942-0x0000024CD50C0000-0x0000024CD50E0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4464-965-0x0000024CD56A0000-0x0000024CD56C0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4896-1232-0x0000000002740000-0x0000000002741000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4984-789-0x0000030266330000-0x0000030266350000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4984-785-0x0000030265400000-0x0000030265500000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/4984-784-0x0000030265400000-0x0000030265500000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/4984-818-0x0000030266900000-0x0000030266920000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4984-799-0x00000302662F0000-0x0000030266310000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download