Overview

overview

10

Static

static

3

JaffaCakes...fe.exe

windows7-x64

10

JaffaCakes...fe.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    53s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250313-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2025, 17:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_8e9bd84240c591bb143a4b61f26ad9fe.exe

  • Size

    283KB

  • MD5

    8e9bd84240c591bb143a4b61f26ad9fe

  • SHA1

    ad97e29812f07446824c5faeb6e68e9968201b21

  • SHA256

    4422a1b3418a16eb9e7c1355d098280f8761fcfcda464ba2491a0aac35853fdb

  • SHA512

    1b019d04c869b4f0ed52bdb2a59d380c2cc1336318d964610fb06fbe98a6f24b897c7807660d673f9c238a9ba6bfbabffabe92e2873adca433777cc084486ecd

  • SSDEEP

    6144:VDplsnscrEZGUT1eIbLNPSkLpwDDMfZbwVts92qo1bY:1boEZTeWsJDMdwV292qo1b

Score
10/10
cycbotponybackdoorcredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 7 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 14 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8e9bd84240c591bb143a4b61f26ad9fe.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8e9bd84240c591bb143a4b61f26ad9fe.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1952
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8e9bd84240c591bb143a4b61f26ad9fe.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8e9bd84240c591bb143a4b61f26ad9fe.exe startC:\Users\Admin\AppData\Roaming\2C01D\E565B.exe%C:\Users\Admin\AppData\Roaming\2C01D
      2⤵
      • System Location Discovery: System Language Discovery
      PID:316
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8e9bd84240c591bb143a4b61f26ad9fe.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8e9bd84240c591bb143a4b61f26ad9fe.exe startC:\Program Files (x86)\1DFA2\lvvm.exe%C:\Program Files (x86)\1DFA2
      2⤵
      • System Location Discovery: System Language Discovery
      PID:6096
    • C:\Program Files (x86)\LP\5B12\3C58.tmp
      "C:\Program Files (x86)\LP\5B12\3C58.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4744
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4364
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Program Files (x86)\LP\5B12\F97.exe
    1⤵
      PID:5180
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1720
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2460
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5344
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5228
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3900
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2000
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:6100
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Suspicious use of SendNotifyMessage
      PID:1580
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:5956
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:1984
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3572
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3588
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:2068
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4316
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3376
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:2928
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:2124
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:2836
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:3688
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:1640
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:3636
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:2784
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:5712
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:5044
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:1280
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:2352
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:6140
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:3764
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:4340
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:3016
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:5692
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:2352
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:1672
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:3892
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:5376
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:3924
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:2460
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:2756
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:3364
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:5284
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:5292
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3316
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:5816
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:4552
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:2812
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:6028
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:4620
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:1308
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:3796
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:2352
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:4900
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:5148
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:3220
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:1064
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:2776
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:5208
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:4936
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:2168
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:4988
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:828
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:4804
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:1716
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:4256
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:4012
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:3684
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:5224
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:748
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                            1⤵
                                                                                                              PID:4544
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:1708
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:3900
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                  1⤵
                                                                                                                    PID:4716
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:4844
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                      1⤵
                                                                                                                        PID:4912
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                        1⤵
                                                                                                                          PID:4340

                                                                                                                        Network

                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                        Reconnaissance

                                                                                                                        Resource Development

                                                                                                                        Initial Access

                                                                                                                        Execution

                                                                                                                        Persistence

                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                        2
                                                                                                                        T1547

                                                                                                                        Active Setup

                                                                                                                        1
                                                                                                                        T1547.014

                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                        1
                                                                                                                        T1547.001

                                                                                                                        Create or Modify System Process

                                                                                                                        1
                                                                                                                        T1543

                                                                                                                        Windows Service

                                                                                                                        1
                                                                                                                        T1543.003

                                                                                                                        Privilege Escalation

                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                        2
                                                                                                                        T1547

                                                                                                                        Active Setup

                                                                                                                        1
                                                                                                                        T1547.014

                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                        1
                                                                                                                        T1547.001

                                                                                                                        Create or Modify System Process

                                                                                                                        1
                                                                                                                        T1543

                                                                                                                        Windows Service

                                                                                                                        1
                                                                                                                        T1543.003

                                                                                                                        Defense Evasion

                                                                                                                        Modify Registry

                                                                                                                        5
                                                                                                                        T1112

                                                                                                                        Credential Access

                                                                                                                        Credentials from Password Stores

                                                                                                                        1
                                                                                                                        T1555

                                                                                                                        Credentials from Web Browsers

                                                                                                                        1
                                                                                                                        T1555.003

                                                                                                                        Unsecured Credentials

                                                                                                                        3
                                                                                                                        T1552

                                                                                                                        Credentials In Files

                                                                                                                        3
                                                                                                                        T1552.001

                                                                                                                        Discovery

                                                                                                                        Peripheral Device Discovery

                                                                                                                        2
                                                                                                                        T1120

                                                                                                                        Query Registry

                                                                                                                        4
                                                                                                                        T1012

                                                                                                                        System Information Discovery

                                                                                                                        2
                                                                                                                        T1082

                                                                                                                        System Location Discovery

                                                                                                                        1
                                                                                                                        T1614

                                                                                                                        System Language Discovery

                                                                                                                        1
                                                                                                                        T1614.001

                                                                                                                        Lateral Movement

                                                                                                                        Collection

                                                                                                                        Data from Local System

                                                                                                                        2
                                                                                                                        T1005

                                                                                                                        Command and Control

                                                                                                                        Exfiltration

                                                                                                                        Impact

                                                                                                                        Replay Monitor

                                                                                                                        Loading Replay Monitor...

                                                                                                                        Downloads

                                                                                                                        • C:\Program Files (x86)\LP\5B12\3C58.tmp
                                                                                                                          Filesize

                                                                                                                          99KB

                                                                                                                          MD5

                                                                                                                          8512e7236d6f175a95604ed7d843b20a

                                                                                                                          SHA1

                                                                                                                          7f35c53dce0af6129bca3d199a84235df9bd6ef4

                                                                                                                          SHA256

                                                                                                                          1cd98423b66062336bd5d06de36b0747482abeb4e526a9719d3d659bc3fc0edd

                                                                                                                          SHA512

                                                                                                                          2031122102d22b834d33eecfb123f422bab250222774f2d2ce1f2d3e9df87a27202979f0cbf42592d92c5c164a133b56272202da1a61d3a84549ddb32fd70542

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                          Filesize

                                                                                                                          471B

                                                                                                                          MD5

                                                                                                                          c2c4e29c12b8e8a12e95957ce3dbd5d0

                                                                                                                          SHA1

                                                                                                                          d24e2cad83d65b4e8e946a406a5404952862580a

                                                                                                                          SHA256

                                                                                                                          54035918f1376378870ca62f8c7676e00938d0558d3362371feb0be6be9c1782

                                                                                                                          SHA512

                                                                                                                          de41a0e2751892dbb91ae925f768161de62c7b909e0207018d63cf3e4108aa09dfc6a3821401e85ba31c8c06b205abfc1f34d59dcbf57eeb9f3296382d8fa6f9

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                          Filesize

                                                                                                                          412B

                                                                                                                          MD5

                                                                                                                          e0d698f026ea6bca29396d01b9f0d580

                                                                                                                          SHA1

                                                                                                                          a052216cf93767da45d407399647125c08f4ca67

                                                                                                                          SHA256

                                                                                                                          ba35546c7da2e7d1a93186de26575cf95ae00e0b3567ddbb41c0d40284acde28

                                                                                                                          SHA512

                                                                                                                          720ba26d080a934e5e87cd0cbe378fb11b6441979cdc000f01721da8fb65a7e3081da10b3448c609cf6ad1bff842a5682ff9ca0fcbd16a763f5dbe60f0be3fb2

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          4b566a8b3ce070e902225b269184d255

                                                                                                                          SHA1

                                                                                                                          4a2c22f6f349feedde7d29db61673b79fa476621

                                                                                                                          SHA256

                                                                                                                          d1e831ebc535387f046c7d41bc43b6846018ff563fd4531fffee44573a858ae2

                                                                                                                          SHA512

                                                                                                                          3b39520e9b652b4c0ef48d203409c0d569eed98c738fbcfef5731fdfe19ce21d60f42a17b720c6b6e8ca0f9e6fe48aee327480cfd9e953579a8de9def5142dce

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133877569575017367.txt
                                                                                                                          Filesize

                                                                                                                          87KB

                                                                                                                          MD5

                                                                                                                          4de1b6c338e29ff2744d3cbf1763f2c4

                                                                                                                          SHA1

                                                                                                                          ec1ede24ac93f1a07ed6f9493eff4eeace9cb442

                                                                                                                          SHA256

                                                                                                                          f9dadf7b21e7b63da123de036f107193f0a313b2081abd7adf0e17aa47337c4a

                                                                                                                          SHA512

                                                                                                                          43f091feb960e08209f66c838444de12e37d4cb262014c0dc9c9ab3b78046169722f3064562ae54febcde6399ed2cfb3be84c784b511766795f17daa45cdf6c3

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4SYNGCCS\microsoft.windows[1].xml
                                                                                                                          Filesize

                                                                                                                          97B

                                                                                                                          MD5

                                                                                                                          6d17534a0db982351137005fa6a7151e

                                                                                                                          SHA1

                                                                                                                          64fa1b1c32dc38667bea9e6383a5384f083e342c

                                                                                                                          SHA256

                                                                                                                          c1227471a38cb5a85f639fcbb0e9201f4c3c080180b4eac3d7e82cc30948b2c4

                                                                                                                          SHA512

                                                                                                                          b64c844e42f880293aa080c52f9635d7b7bf12a001692438bd184b6a6be989fcbae0e98ede275ebddae75e2ae5cfb2cfa055d366760bfb9e2ba78da0f0f0d915

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Roaming\2C01D\DFA2.C01
                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          e22572d1654a28abf00dbf73f0213101

                                                                                                                          SHA1

                                                                                                                          99cc9b5325a25b6c746fd029ae54de894bd850e2

                                                                                                                          SHA256

                                                                                                                          cf77894b00ad870cf88b40674125ce5d5cc151b1a0640d7fba2545860818e9a8

                                                                                                                          SHA512

                                                                                                                          44cdb6248185fd66b0f4f684a5e2cf066e77063806008d1f252d3b34544fa5d3b66a50ac8b4fa5fa599faff6c32444b93837664aba72c0afc16cf98ae8e32b43

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Roaming\2C01D\DFA2.C01
                                                                                                                          Filesize

                                                                                                                          600B

                                                                                                                          MD5

                                                                                                                          ac79174418c42ec8cc56b80c92faa31b

                                                                                                                          SHA1

                                                                                                                          a031da0844e6688e30269138dfbcdb59d84c01cb

                                                                                                                          SHA256

                                                                                                                          70828f1bf76c0349db167bf38c0de9978a74826c3cd3e5c55382d0fe847b3e8d

                                                                                                                          SHA512

                                                                                                                          3726e4b93c9cd660feb5febf61ff8174eb3ab7fb85fe5b8babf31ff04e71533c4ca5699a691968eff1bfb661f7709c6dcd2b3a0a37fcdb7366de458d34d6319b

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Roaming\2C01D\DFA2.C01
                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          f27cf01ee5f7a65cfbfd28cf0e5abd49

                                                                                                                          SHA1

                                                                                                                          17e9473b42302cd14e4068e88ab6bd2ee8c3d3da

                                                                                                                          SHA256

                                                                                                                          0b0cb215f1bbe71a3238242bbf8259f475918a01519f52b1a034b8fe4a105a99

                                                                                                                          SHA512

                                                                                                                          014d2c4c4c4628c6343ee1a49eb42650625bff8e08c7e733cdf61df185e1a8504f8ed0829027258c7519fd49fe871fce5a138f036c2d3fc1a474cf6e69ad5658

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Roaming\2C01D\DFA2.C01
                                                                                                                          Filesize

                                                                                                                          996B

                                                                                                                          MD5

                                                                                                                          b9f15b75f822ea6046fc858cdfed90d8

                                                                                                                          SHA1

                                                                                                                          cbf05cd763475019970936216d04bbaa9b61df3a

                                                                                                                          SHA256

                                                                                                                          a9f9effbdc50d4963dba7378120a1b859a1cadc0414c759623a8097d65546830

                                                                                                                          SHA512

                                                                                                                          a75a3f93ca275c1a2c33f083f97726b58bd38a2775db14071ce63de14fedeb138428f77fe3fd3474b4390b747fb4d67c254664550d780f92764714142b9e5d9e

                                                                                                                          Download Submit

                                                                                                                        • memory/316-15-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          428KB

                                                                                                                          Download

                                                                                                                        • memory/316-14-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          428KB

                                                                                                                          Download

                                                                                                                        • memory/1640-649-0x0000022879F00000-0x000002287A000000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                          Download

                                                                                                                        • memory/1640-654-0x000002287B020000-0x000002287B040000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/1640-677-0x000002287B3E0000-0x000002287B400000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/1640-666-0x000002287ADD0000-0x000002287ADF0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/1640-650-0x0000022879F00000-0x000002287A000000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                          Download

                                                                                                                        • memory/1952-1072-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          428KB

                                                                                                                          Download

                                                                                                                        • memory/1952-11-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          428KB

                                                                                                                          Download

                                                                                                                        • memory/1952-79-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          428KB

                                                                                                                          Download

                                                                                                                        • memory/1952-2-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          428KB

                                                                                                                          Download

                                                                                                                        • memory/1952-12-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          416KB

                                                                                                                          Download

                                                                                                                        • memory/1952-346-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          428KB

                                                                                                                          Download

                                                                                                                        • memory/1952-1-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          416KB

                                                                                                                          Download

                                                                                                                        • memory/1984-347-0x0000000004710000-0x0000000004711000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/2068-500-0x0000000004D60000-0x0000000004D61000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/2352-979-0x000001F8FB210000-0x000001F8FB230000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/2352-943-0x000001F8F9D00000-0x000001F8F9E00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                          Download

                                                                                                                        • memory/2352-959-0x000001F8FAE00000-0x000001F8FAE20000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/2352-1215-0x0000029A21560000-0x0000029A21580000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/2352-1217-0x0000029A21520000-0x0000029A21540000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/2352-947-0x000001F8FAE40000-0x000001F8FAE60000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/2352-942-0x000001F8F9D00000-0x000001F8F9E00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                          Download

                                                                                                                        • memory/2352-1209-0x0000029A20600000-0x0000029A20700000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                          Download

                                                                                                                        • memory/2352-1210-0x0000029A20600000-0x0000029A20700000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                          Download

                                                                                                                        • memory/2352-1229-0x0000029A21B40000-0x0000029A21B60000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/2836-648-0x00000000042C0000-0x00000000042C1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/3016-1208-0x0000000004610000-0x0000000004611000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/3376-507-0x000002DAF4F60000-0x000002DAF4F80000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/3376-538-0x000002DAF5520000-0x000002DAF5540000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/3376-503-0x000002DAF4000000-0x000002DAF4100000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                          Download

                                                                                                                        • memory/3376-511-0x000002DAF4F20000-0x000002DAF4F40000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/3376-502-0x000002DAF4000000-0x000002DAF4100000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                          Download

                                                                                                                        • memory/3588-354-0x000002A103580000-0x000002A1035A0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/3588-363-0x000002A103540000-0x000002A103560000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/3588-350-0x000002A102420000-0x000002A102520000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                          Download

                                                                                                                        • memory/3588-351-0x000002A102420000-0x000002A102520000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                          Download

                                                                                                                        • memory/3588-349-0x000002A102420000-0x000002A102520000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                          Download

                                                                                                                        • memory/3588-382-0x000002A103950000-0x000002A103970000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/3636-796-0x00000000049C0000-0x00000000049C1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/3900-184-0x00000000047C0000-0x00000000047C1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/4340-1102-0x0000026CFB520000-0x0000026CFB540000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/4340-1091-0x0000026CFB120000-0x0000026CFB140000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/4340-1082-0x0000026CFB160000-0x0000026CFB180000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/4744-310-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          112KB

                                                                                                                          Download

                                                                                                                        • memory/5044-940-0x0000000004640000-0x0000000004641000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/5712-835-0x0000029973DD0000-0x0000029973DF0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/5712-815-0x00000299739C0000-0x00000299739E0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/5712-803-0x0000029973A00000-0x0000029973A20000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/5712-799-0x0000029972900000-0x0000029972A00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                          Download

                                                                                                                        • memory/5712-798-0x0000029972900000-0x0000029972A00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                          Download

                                                                                                                        • memory/6096-81-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          428KB

                                                                                                                          Download

                                                                                                                        • memory/6100-221-0x000002A47BD30000-0x000002A47BD50000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/6100-199-0x000002A47B920000-0x000002A47B940000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/6100-185-0x000002A47A940000-0x000002A47AA40000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                          Download

                                                                                                                        • memory/6100-190-0x000002A47B960000-0x000002A47B980000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                          Download

                                                                                                                        • memory/6100-186-0x000002A47A940000-0x000002A47AA40000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                          Download

                                                                                                                        • memory/6140-1074-0x0000000003800000-0x0000000003801000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download