Analysis

  • max time kernel
    60s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-06-2024 23:00

General

  • Target

    0017c17069fcd00a8c13e2e1bb955494_JaffaCakes118.exe

  • Size

    269KB

  • MD5

    0017c17069fcd00a8c13e2e1bb955494

  • SHA1

    e12d88f2d4493b8bd9a032b592802f7d72af3ffc

  • SHA256

    6cc4a73d5534504263a2fe5e7b2cc95269f151bb032ea22fb8ad55fbc8f4a94f

  • SHA512

    b29db9dfe9bd70c8b16584555e7ee32487b92996ee251a9f6c5ef2f266ab01ba1a77ec36954fd6a767a1d0e8ed48afe2314a11902eb104dd92f4080eccc21759

  • SSDEEP

    6144:+dVLk+QT3LPhQurUJKD/W9DvLUq8WmHKpv9RALcbM0540/Ix0BY71OT:pZJ4Dvg8mab62q0/I2aB2

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables taskbar notifications via registry modification
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 16 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0017c17069fcd00a8c13e2e1bb955494_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0017c17069fcd00a8c13e2e1bb955494_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:6044
    • C:\Users\Admin\AppData\Local\Temp\0017c17069fcd00a8c13e2e1bb955494_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\0017c17069fcd00a8c13e2e1bb955494_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\B29E3\F1560.exe%C:\Users\Admin\AppData\Roaming\B29E3
      2⤵
        PID:3612
      • C:\Users\Admin\AppData\Local\Temp\0017c17069fcd00a8c13e2e1bb955494_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\0017c17069fcd00a8c13e2e1bb955494_JaffaCakes118.exe startC:\Program Files (x86)\E3692\lvvm.exe%C:\Program Files (x86)\E3692
        2⤵
          PID:1504
        • C:\Program Files (x86)\LP\60DB\BD93.tmp
          "C:\Program Files (x86)\LP\60DB\BD93.tmp"
          2⤵
          • Executes dropped EXE
          PID:4664
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2324
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1180
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4712
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4192
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4944
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4640
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4200
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3844
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:3640
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:6060
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4592
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:3328
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5020
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4268
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4952
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3748
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3996
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:388
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:5264
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5156
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:5608
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3300
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1784
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Modifies registry class
        PID:616
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:1460
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:3480
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:3644
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:2136
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:1824
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:5388
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:3368
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:2780
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:3516
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:2092
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:2484
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:4152
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:6016
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:4148
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:2208
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:3228
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:3428
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:5592
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:232
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:2812
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:2816
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:2828
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:2488
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:4656
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:1768
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:1180
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:2632
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:648
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:4032
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:3028
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:2732
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:860
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:1560
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:4296
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:5612
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:5812
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:4928
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:5636
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:2176
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:3340
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                        1⤵
                                                                                          PID:2424
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:2140
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:5696
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                                PID:5540
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:3456
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:3024
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                    1⤵
                                                                                                      PID:5484
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:5356
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                          PID:5500
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:4020
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                            1⤵
                                                                                                              PID:5644
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                              1⤵
                                                                                                                PID:5464
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:4768
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                  1⤵
                                                                                                                    PID:1968
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                    1⤵
                                                                                                                      PID:5496

                                                                                                                    Network

                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    • C:\Program Files (x86)\LP\60DB\BD93.tmp

                                                                                                                      Filesize

                                                                                                                      100KB

                                                                                                                      MD5

                                                                                                                      27b8687e24697667947df4286451c333

                                                                                                                      SHA1

                                                                                                                      0cd88bd22b3df42297d60fd3c257fca10b4a1bc7

                                                                                                                      SHA256

                                                                                                                      664dcbc21da837aa84d9161ce3c448737e4fc4c6f8f9ebc713eb5bce171ba950

                                                                                                                      SHA512

                                                                                                                      cd20429833bcdad819e4d9ebd2223d1b6adfca2becb006497e7ea8935e856b7fcef32ac321604b68f237bf114671e9c6a78ea7854b6d709621c1628aa86bc44e

                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                                                      Filesize

                                                                                                                      471B

                                                                                                                      MD5

                                                                                                                      33ab7b3779b137974874e499752c9e7f

                                                                                                                      SHA1

                                                                                                                      62689056e1e91959c01bc2b52c7699a267b8a389

                                                                                                                      SHA256

                                                                                                                      630836cfaf4ce930cb28cb182352ab0e370577e1f308e9a171488d4996f091f9

                                                                                                                      SHA512

                                                                                                                      48d951529fef5e953d8f363c1ffd7bbd053acbb3fc3e8a6c0ec08659e7356927909931e6212bfe21266e245a5101da6532f8b38b6ba899baaf32f02f547b72be

                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                                                      Filesize

                                                                                                                      420B

                                                                                                                      MD5

                                                                                                                      7d2a08d335a685b44f69b18abbebaa3a

                                                                                                                      SHA1

                                                                                                                      55283fd4d3c0098c0e7975ed5ce8f666e0620b0e

                                                                                                                      SHA256

                                                                                                                      5806895affe992ab80f636bee4f17e8eafd0f691b251b1659c935e5a090fba3c

                                                                                                                      SHA512

                                                                                                                      c486b5a67c820a11059bb959f019039fb31bc330465e5d4f00db274ece422abb39910c2313def585ac4023dbb335b1617949f553894c8ba21f1fa38a84ba9e7c

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      1edd525dd0453ef7f4f11b88daf61d46

                                                                                                                      SHA1

                                                                                                                      cb1061615e7fcd44d4f3285cb97bfe125899f2e1

                                                                                                                      SHA256

                                                                                                                      f1c33a7f92ae84ba61ca6dfa6c85b14f6551da824e96e4704b97602a6fc4fac4

                                                                                                                      SHA512

                                                                                                                      cb11cc985717a3b31e6cd24a24a5564885e343dfe41f715618a4e7365d3a8bcf4f3ed00adbe916331dcca7b35026dae27279f6a2d9f7100dd2fd3e65d2e4d5ba

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15

                                                                                                                      Filesize

                                                                                                                      36KB

                                                                                                                      MD5

                                                                                                                      0e2a09c8b94747fa78ec836b5711c0c0

                                                                                                                      SHA1

                                                                                                                      92495421ad887f27f53784c470884802797025ad

                                                                                                                      SHA256

                                                                                                                      0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                                                                      SHA512

                                                                                                                      61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel

                                                                                                                      Filesize

                                                                                                                      36KB

                                                                                                                      MD5

                                                                                                                      fb5f8866e1f4c9c1c7f4d377934ff4b2

                                                                                                                      SHA1

                                                                                                                      d0a329e387fb7bcba205364938417a67dbb4118a

                                                                                                                      SHA256

                                                                                                                      1649ec9493be27f76ae7304927d383f8a53dd3e41ea1678bacaff33120ea4170

                                                                                                                      SHA512

                                                                                                                      0fbe2843dfeab7373cde0643b20c073fdc2fcbefc5ae581fd1656c253dfa94e8bba4d348e95cc40d1e872456ecca894b462860aeac8b92cedb11a7cad634798c

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\6KUWUA35\microsoft.windows[1].xml

                                                                                                                      Filesize

                                                                                                                      97B

                                                                                                                      MD5

                                                                                                                      689df38489ed790b0068b7f3cae1d440

                                                                                                                      SHA1

                                                                                                                      6df6ffaae31903b96024a7b81f25f1ed61c3f152

                                                                                                                      SHA256

                                                                                                                      fc336b0ef0f4f06ea66d92f25dd66dd1b0d697da62b5073ed5199fffac8a08aa

                                                                                                                      SHA512

                                                                                                                      1f26ccb99ee3babc3617eb635a75f02d34be865c200a866eb28024ad0d8ccbe4110b0dd1a3d2ab14fd84b2eb345fed8bb65a19437ff99c1b2d84e2b3ce9acbb2

                                                                                                                    • C:\Users\Admin\AppData\Roaming\B29E3\3692.29E

                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      4c537e942824ade5cb1637d757e5b4ac

                                                                                                                      SHA1

                                                                                                                      8c853126bf0147deaba3e54f241bffee5bce37c2

                                                                                                                      SHA256

                                                                                                                      788db2e2863ec3121fc16984fb6e7ae38f367399cd98b007c68cc6c3dd65ec8e

                                                                                                                      SHA512

                                                                                                                      6e4c3ab18ec83f1da85d4696d7314d266935a1975be1729b09137f634321a30a725ff6efc4c81bd26378d6b96738439c677d050b88264aef6afc12cd3fe88abe

                                                                                                                    • C:\Users\Admin\AppData\Roaming\B29E3\3692.29E

                                                                                                                      Filesize

                                                                                                                      600B

                                                                                                                      MD5

                                                                                                                      32ebc2cdfb004be4df4ccdde049edf62

                                                                                                                      SHA1

                                                                                                                      5abe480d6c7fef77123a4c2e66cdd47bfc533b97

                                                                                                                      SHA256

                                                                                                                      1813137c8c6f9e0e876afd99a8637fdf23a5618468ed567ea945a9078f3835e1

                                                                                                                      SHA512

                                                                                                                      60ae448462a4f3eb02f08900ce2259fd63633a5a478e64b78f52ea713796a0af6f45ae1cb8a0d9430dfff0d586f22d1f39ba63bd149ae7e09ac8e55c310de920

                                                                                                                    • C:\Users\Admin\AppData\Roaming\B29E3\3692.29E

                                                                                                                      Filesize

                                                                                                                      996B

                                                                                                                      MD5

                                                                                                                      5450e65d512442b2aa94a64809633b4b

                                                                                                                      SHA1

                                                                                                                      64799ce71b93fbb45b085b6465fbd03d865ae178

                                                                                                                      SHA256

                                                                                                                      2d4bec9a70c82de801f0e3941f1f0094fad54191a5ba327daf688fa9472b4f32

                                                                                                                      SHA512

                                                                                                                      aee3535076cc486d147774239576bebffabb5cd5cc0ed2efc5f2af000e5df02b6f6f93773944d70f2bd18f6c3b2c31029a7dff1f8ee9240e0cf9ee918d540c6f

                                                                                                                    • memory/388-805-0x00000000049D0000-0x00000000049D1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/616-1102-0x00000000041D0000-0x00000000041D1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/1504-80-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      432KB

                                                                                                                    • memory/1784-988-0x000001E0D64C0000-0x000001E0D64E0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1784-957-0x000001E0D6100000-0x000001E0D6120000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1784-968-0x000001E0D5DB0000-0x000001E0D5DD0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1824-1258-0x00000250A1B70000-0x00000250A1B90000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1824-1290-0x00000250A1F40000-0x00000250A1F60000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/1824-1255-0x00000250A0A20000-0x00000250A0B20000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1024KB

                                                                                                                    • memory/1824-1254-0x00000250A0A20000-0x00000250A0B20000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1024KB

                                                                                                                    • memory/1824-1253-0x00000250A0A20000-0x00000250A0B20000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1024KB

                                                                                                                    • memory/1824-1283-0x00000250A1B30000-0x00000250A1B50000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2484-1554-0x00000209F5C20000-0x00000209F5D20000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1024KB

                                                                                                                    • memory/2484-1559-0x00000209F6D70000-0x00000209F6D90000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2484-1574-0x00000209F6D30000-0x00000209F6D50000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2484-1581-0x00000209F7140000-0x00000209F7160000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2780-1416-0x0000024BEDBC0000-0x0000024BEDBE0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2780-1401-0x0000024BECB00000-0x0000024BECC00000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1024KB

                                                                                                                    • memory/2780-1406-0x0000024BEDC00000-0x0000024BEDC20000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2780-1428-0x0000024BEDFD0000-0x0000024BEDFF0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/2780-1402-0x0000024BECB00000-0x0000024BECC00000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1024KB

                                                                                                                    • memory/3328-500-0x00000000042B0000-0x00000000042B1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/3480-1141-0x00000153BC510000-0x00000153BC530000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3480-1119-0x00000153BC100000-0x00000153BC120000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3480-1109-0x00000153BC140000-0x00000153BC160000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3516-1553-0x00000000040A0000-0x00000000040A1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/3612-14-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      432KB

                                                                                                                    • memory/3640-354-0x0000000004E50000-0x0000000004E51000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/3644-1252-0x0000000004B50000-0x0000000004B51000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/3844-204-0x00000229BC7C0000-0x00000229BC7E0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3844-193-0x00000229BC800000-0x00000229BC820000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3844-219-0x00000229BCBD0000-0x00000229BCBF0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3996-659-0x00000173B41F0000-0x00000173B4210000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3996-691-0x00000173B45C0000-0x00000173B45E0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/3996-679-0x00000173B41B0000-0x00000173B41D0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4152-1702-0x00000000027D0000-0x00000000027D1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4268-503-0x0000021789D00000-0x0000021789E00000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1024KB

                                                                                                                    • memory/4268-504-0x0000021789D00000-0x0000021789E00000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1024KB

                                                                                                                    • memory/4268-539-0x000002178B1D0000-0x000002178B1F0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4268-522-0x000002178ADC0000-0x000002178ADE0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4268-502-0x0000021789D00000-0x0000021789E00000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1024KB

                                                                                                                    • memory/4268-507-0x000002178AE00000-0x000002178AE20000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4592-393-0x000001B5838C0000-0x000001B5838E0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4592-371-0x000001B5832A0000-0x000001B5832C0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4592-361-0x000001B5832E0000-0x000001B583300000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/4640-186-0x0000000002A50000-0x0000000002A51000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4664-352-0x0000000000400000-0x000000000041D000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      116KB

                                                                                                                    • memory/4952-653-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/5156-835-0x000001810EC30000-0x000001810EC50000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/5156-824-0x000001810E820000-0x000001810E840000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/5156-813-0x000001810E860000-0x000001810E880000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                    • memory/5388-1399-0x0000000004570000-0x0000000004571000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/5608-949-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/6044-1513-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      432KB

                                                                                                                    • memory/6044-617-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      432KB

                                                                                                                    • memory/6044-110-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      420KB

                                                                                                                    • memory/6044-78-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      432KB

                                                                                                                    • memory/6044-1-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      420KB

                                                                                                                    • memory/6044-11-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      432KB

                                                                                                                    • memory/6044-2-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      432KB