Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2025, 06:09

General

  • Target

    32af824687697346da2d415bfb80fa29.exe

  • Size

    13.1MB

  • MD5

    32af824687697346da2d415bfb80fa29

  • SHA1

    bc83dec747cc6fc84c61df9df6d0ca5e82227040

  • SHA256

    cc1927347aa066e1fca14fe1669362dd817ee950f9727a38e3a7b8ced8553062

  • SHA512

    873e74cd1623ee150d3528ba42875048e379e1a577b828215c35f4375bd9817ab25c21113353c3107dc4ab3bcd076a6df5191647c19b373e1472d1b38fbca719

  • SSDEEP

    6144:RAIvHAsjfyx0Sd/jkraPjhEe6VlWT8b9AtHqrXjXx4uzTb8M59cTT4l2P:RAWx5raEPVle8/rttzEccTQY

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 46 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\32af824687697346da2d415bfb80fa29.exe
    "C:\Users\Admin\AppData\Local\Temp\32af824687697346da2d415bfb80fa29.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2892
    • C:\Windows\system32\CMD.exe
      "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Outlook" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Outlook" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2592
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2596
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1672
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Wireshark Host" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:588
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo 5 /tn "Wireshark Host" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft Visual Studio.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2100
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1668
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:1152
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1908
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:2936
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2440
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:2208
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1332
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:1056
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1516
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:1720
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2428
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:2312
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2352
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:1304
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2988
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:2572
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2568
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:3060
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2124
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:2380
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1396
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:2288
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:480
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:1976
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3024
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:1680
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1376
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:1104
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1776
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:1852
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2264
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:3012
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2344
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:1580
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2444
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:2676
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2884
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:2596
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:560
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:1576
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2536
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:2652
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2936
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:1804
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2768
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:1960
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2296
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:2836
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1404
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:1868
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1300
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:2424
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1664
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:1600
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2612
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:2876
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1820
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:2452
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1576
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:1348
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:552
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:2944
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2432
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        • Suspicious behavior: EnumeratesProcesses
        PID:2036
    • C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
      2⤵
        PID:3036
        • C:\Windows\system32\schtasks.exe
          SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:972
      • C:\Windows\system32\CMD.exe
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
        2⤵
          PID:2180
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3032
        • C:\Windows\system32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
          2⤵
            PID:2544
            • C:\Windows\system32\schtasks.exe
              SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:1736
          • C:\Windows\system32\CMD.exe
            "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
            2⤵
              PID:996
              • C:\Windows\system32\schtasks.exe
                SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:708
            • C:\Windows\system32\CMD.exe
              "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
              2⤵
                PID:2324
                • C:\Windows\system32\schtasks.exe
                  SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
                  3⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:1300
              • C:\Windows\system32\CMD.exe
                "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
                2⤵
                  PID:2124
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
                    3⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:2900
                • C:\Windows\system32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
                  2⤵
                    PID:3068
                    • C:\Windows\system32\schtasks.exe
                      SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
                      3⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:2552
                  • C:\Windows\system32\CMD.exe
                    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
                    2⤵
                      PID:764
                      • C:\Windows\system32\schtasks.exe
                        SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
                        3⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:1060
                    • C:\Windows\system32\CMD.exe
                      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
                      2⤵
                        PID:1396
                        • C:\Windows\system32\schtasks.exe
                          SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
                          3⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:1908
                      • C:\Windows\system32\CMD.exe
                        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
                        2⤵
                          PID:2236
                          • C:\Windows\system32\schtasks.exe
                            SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
                            3⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:680
                        • C:\Windows\system32\CMD.exe
                          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
                          2⤵
                            PID:908
                            • C:\Windows\system32\schtasks.exe
                              SchTaSKs /create /f /sc minute /mo -1 /tn "Visual Studio Code Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\xdwdCorelDRAW.exe" /RL HIGHEST
                              3⤵
                              • Scheduled Task/Job: Scheduled Task
                              PID:1100

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Windows\xdwd.dll

                          Filesize

                          136KB

                          MD5

                          16e5a492c9c6ae34c59683be9c51fa31

                          SHA1

                          97031b41f5c56f371c28ae0d62a2df7d585adaba

                          SHA256

                          35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

                          SHA512

                          20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

                        • memory/480-367-0x000007FEF73F0000-0x000007FEF7412000-memory.dmp

                          Filesize

                          136KB

                        • memory/552-904-0x000007FEF7480000-0x000007FEF74A2000-memory.dmp

                          Filesize

                          136KB

                        • memory/560-596-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/1056-142-0x000007FEF73F0000-0x000007FEF7412000-memory.dmp

                          Filesize

                          136KB

                        • memory/1104-422-0x000007FEF73F0000-0x000007FEF7412000-memory.dmp

                          Filesize

                          136KB

                        • memory/1152-60-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/1300-764-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/1304-226-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/1332-143-0x000007FEF73F0000-0x000007FEF7412000-memory.dmp

                          Filesize

                          136KB

                        • memory/1348-870-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/1376-423-0x000007FEF73F0000-0x000007FEF7412000-memory.dmp

                          Filesize

                          136KB

                        • memory/1396-344-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/1404-736-0x000007FEF7480000-0x000007FEF74A2000-memory.dmp

                          Filesize

                          136KB

                        • memory/1516-176-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/1576-592-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/1576-871-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/1580-511-0x000007FEF7480000-0x000007FEF74A2000-memory.dmp

                          Filesize

                          136KB

                        • memory/1600-791-0x000007FEF7480000-0x000007FEF74A2000-memory.dmp

                          Filesize

                          136KB

                        • memory/1664-792-0x000007FEF7480000-0x000007FEF74A2000-memory.dmp

                          Filesize

                          136KB

                        • memory/1668-123-0x0000000077180000-0x0000000077329000-memory.dmp

                          Filesize

                          1.7MB

                        • memory/1668-61-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/1668-62-0x0000000077180000-0x0000000077329000-memory.dmp

                          Filesize

                          1.7MB

                        • memory/1668-54-0x00000000771D1000-0x00000000771D2000-memory.dmp

                          Filesize

                          4KB

                        • memory/1680-399-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/1720-170-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/1776-456-0x000007FEF7480000-0x000007FEF74A2000-memory.dmp

                          Filesize

                          136KB

                        • memory/1804-652-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/1820-848-0x000007FEF7480000-0x000007FEF74A2000-memory.dmp

                          Filesize

                          136KB

                        • memory/1852-451-0x000007FEF7480000-0x000007FEF74A2000-memory.dmp

                          Filesize

                          136KB

                        • memory/1868-735-0x000007FEF7480000-0x000007FEF74A2000-memory.dmp

                          Filesize

                          136KB

                        • memory/1908-85-0x000007FEF73F0000-0x000007FEF7412000-memory.dmp

                          Filesize

                          136KB

                        • memory/1960-679-0x000007FEF7480000-0x000007FEF74A2000-memory.dmp

                          Filesize

                          136KB

                        • memory/1976-366-0x000007FEF73F0000-0x000007FEF7412000-memory.dmp

                          Filesize

                          136KB

                        • memory/2036-926-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/2124-311-0x000007FEF73F0000-0x000007FEF7412000-memory.dmp

                          Filesize

                          136KB

                        • memory/2208-113-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/2264-479-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/2288-343-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/2296-703-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/2312-198-0x000007FEF73F0000-0x000007FEF7412000-memory.dmp

                          Filesize

                          136KB

                        • memory/2344-512-0x000007FEF7480000-0x000007FEF74A2000-memory.dmp

                          Filesize

                          136KB

                        • memory/2352-230-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/2380-310-0x000007FEF73F0000-0x000007FEF7412000-memory.dmp

                          Filesize

                          136KB

                        • memory/2424-763-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/2428-199-0x000007FEF73F0000-0x000007FEF7412000-memory.dmp

                          Filesize

                          136KB

                        • memory/2432-927-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/2440-117-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/2444-535-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/2452-847-0x000007FEF7480000-0x000007FEF74A2000-memory.dmp

                          Filesize

                          136KB

                        • memory/2536-625-0x000007FEF7480000-0x000007FEF74A2000-memory.dmp

                          Filesize

                          136KB

                        • memory/2568-288-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/2572-254-0x000007FEF73F0000-0x000007FEF7412000-memory.dmp

                          Filesize

                          136KB

                        • memory/2596-562-0x000007FEF7480000-0x000007FEF74A2000-memory.dmp

                          Filesize

                          136KB

                        • memory/2612-815-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/2652-624-0x000007FEF7480000-0x000007FEF74A2000-memory.dmp

                          Filesize

                          136KB

                        • memory/2676-534-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/2768-681-0x000007FEF7480000-0x000007FEF74A2000-memory.dmp

                          Filesize

                          136KB

                        • memory/2836-702-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/2876-814-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/2884-568-0x000007FEF7480000-0x000007FEF74A2000-memory.dmp

                          Filesize

                          136KB

                        • memory/2892-1-0x0000000000D10000-0x0000000000D90000-memory.dmp

                          Filesize

                          512KB

                        • memory/2892-94-0x000007FEF4F60000-0x000007FEF594C000-memory.dmp

                          Filesize

                          9.9MB

                        • memory/2892-2-0x000007FEF4F63000-0x000007FEF4F64000-memory.dmp

                          Filesize

                          4KB

                        • memory/2892-34-0x000007FEF4F60000-0x000007FEF594C000-memory.dmp

                          Filesize

                          9.9MB

                        • memory/2892-0-0x000007FEF4F63000-0x000007FEF4F64000-memory.dmp

                          Filesize

                          4KB

                        • memory/2936-653-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/2936-84-0x000007FEF73F0000-0x000007FEF7412000-memory.dmp

                          Filesize

                          136KB

                        • memory/2944-898-0x000007FEF7480000-0x000007FEF74A2000-memory.dmp

                          Filesize

                          136KB

                        • memory/2988-255-0x000007FEF73F0000-0x000007FEF7412000-memory.dmp

                          Filesize

                          136KB

                        • memory/3012-478-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/3024-400-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB

                        • memory/3060-282-0x000007FEF7420000-0x000007FEF7442000-memory.dmp

                          Filesize

                          136KB