Overview

overview

8

Static

static

7

2c19ed699e...18.exe

windows7-x64

8

2c19ed699e...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    24s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-07-2024 11:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2c19ed699ee29594ab26c904740f1344_JaffaCakes118.exe

  • Size

    250KB

  • MD5

    2c19ed699ee29594ab26c904740f1344

  • SHA1

    32a2d1dc0bb2cf4b68e097d5aa570b42e888a1ec

  • SHA256

    965f74d1a79e8a069067d23609b1223c5b81a8cea69465d168a490e8622111b2

  • SHA512

    417dea6e1eba664914d1b4ac0f4d2f2f06eeda52e6c2bbcc085d4b9ecee0deaf632647091f380a527059a3493d71ad513221d1ad4d58a385335961f5c2de3050

  • SSDEEP

    6144:MhieuJDr5T8b2ufqBLjSB/MS7irtIa6cwoD8ZroSfjGFA:9eKrJJuf86AYcwoaoSbr

Score
8/10
executionpersistenceupx

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Program Files directory 2 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 62 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c19ed699ee29594ab26c904740f1344_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2c19ed699ee29594ab26c904740f1344_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1440
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files\WinRAR\winrar.jse"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3092
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.go2000.com/?g8
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2668
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:17410 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2216
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ping -n 4 127.1>nul &del /q "C:\Users\Admin\AppData\Local\Temp\2c19ed699ee29594ab26c904740f1344_JaffaCakes118.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3496
      • C:\Windows\SysWOW64\PING.EXE
        ping -n 4 127.1
        3⤵
        • Runs ping.exe
        PID:4872
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4972
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2332
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
    1⤵
      PID:1920
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2260
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:512
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1440
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:1300
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
      1⤵
        PID:4564
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3852
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:464
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4376
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:1484
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:1060
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:1848
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:2100
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:1184
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:1484
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:5044
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:4324
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:2100
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:1356
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:2792
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:4548
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:2628
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:3396
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:4708
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:1840
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:5060
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:4824
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:2440
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:4280
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:2628
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:1180
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:1968
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:4104
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:1020
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:4816
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:436
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:2000
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:2520
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:3980
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:996
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:3384
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:4412
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:5112
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:1968
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:3940
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:364
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:3148
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:2132
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:4556
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                        1⤵
                                                                                          PID:1408
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:3832
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:4296
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                                PID:4208
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:4144
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:2368
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                    1⤵
                                                                                                      PID:2356
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:996
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                          PID:3800
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                            PID:3096
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:3232
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:3684
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                1⤵
                                                                                                                  PID:1376
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:1344
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                    1⤵
                                                                                                                      PID:216
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                      1⤵
                                                                                                                        PID:1740
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        explorer.exe
                                                                                                                        1⤵
                                                                                                                          PID:3388
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                          1⤵
                                                                                                                            PID:4016
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                            1⤵
                                                                                                                              PID:3132
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              explorer.exe
                                                                                                                              1⤵
                                                                                                                                PID:5068
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                1⤵
                                                                                                                                  PID:4980
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:1512
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:3132
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                      1⤵
                                                                                                                                        PID:5080
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:2400
                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                          explorer.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:1440
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                            1⤵
                                                                                                                                              PID:4116
                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                              1⤵
                                                                                                                                                PID:1396

                                                                                                                                              Network

                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                              Replay Monitor

                                                                                                                                              Loading Replay Monitor...

                                                                                                                                              Downloads

                                                                                                                                              • C:\Program Files\WinRAR\winrar.jse
                                                                                                                                                Filesize

                                                                                                                                                11KB

                                                                                                                                                MD5

                                                                                                                                                9208c38b58c7c7114f3149591580b980

                                                                                                                                                SHA1

                                                                                                                                                8154bdee622a386894636b7db046744724c3fc2b

                                                                                                                                                SHA256

                                                                                                                                                cb1b908e509020904b05dc6e4ec17d877d394eb60f6ec0d993ceba5839913a0c

                                                                                                                                                SHA512

                                                                                                                                                a421c6afa6d25185ec52a8218bddf84537407fd2f6cabe38c1be814d97920cfff693a48b4f48eb30c98437cbbb8ad30ccd28c3b4b7c24379ef36ac361ddfdbf1

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LW8AZS3N\suggestions[1].en-US
                                                                                                                                                Filesize

                                                                                                                                                17KB

                                                                                                                                                MD5

                                                                                                                                                5a34cb996293fde2cb7a4ac89587393a

                                                                                                                                                SHA1

                                                                                                                                                3c96c993500690d1a77873cd62bc639b3a10653f

                                                                                                                                                SHA256

                                                                                                                                                c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                                                                                                                                                SHA512

                                                                                                                                                e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                                                Filesize

                                                                                                                                                2KB

                                                                                                                                                MD5

                                                                                                                                                20d672c9cb4930952044513e634dce2c

                                                                                                                                                SHA1

                                                                                                                                                20e37763aaecb56ab1e5f6fe16fef3fd6b7bd6cb

                                                                                                                                                SHA256

                                                                                                                                                c54da3bb7b44fb50244cb57dd85138f91b996f70a38bc24b96662d599193a99d

                                                                                                                                                SHA512

                                                                                                                                                c4a64a179f31d834bed15bc1fd2b77ead74c8e532edbc24a95f275a2975f52ff00e1aa6197e0c57b3a40f497c6a3616157d8bdb2774291b0fa376751b782d7d5

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133649367706307837.txt
                                                                                                                                                Filesize

                                                                                                                                                75KB

                                                                                                                                                MD5

                                                                                                                                                2a6753d50710da0254ee1349130fd262

                                                                                                                                                SHA1

                                                                                                                                                d0dabc6b5f6de13f5c749c014969b800fc9d335f

                                                                                                                                                SHA256

                                                                                                                                                10053e804cf54e465286a523b1cf7b0b3122f7ace050e30539369a26957898df

                                                                                                                                                SHA512

                                                                                                                                                077657969e15ec8a72815ca43d2e7f4945c02cd7b71b624cada74ccbeb94b89ee459b13513043dfe1cd44632a3baf5a1a99d62ff63e6782050f23ca3c74ced89

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4GNLNS14\microsoft.windows[1].xml
                                                                                                                                                Filesize

                                                                                                                                                96B

                                                                                                                                                MD5

                                                                                                                                                ccb66d6c668ede38cd352c15fa6a608a

                                                                                                                                                SHA1

                                                                                                                                                6e522a860e7dc9a40fb6ff80c4c286dd1ce281cd

                                                                                                                                                SHA256

                                                                                                                                                c7cd4df096aedb5fee5815d2f4b51d098c8b82bc1ed9ba400c5c40935301e665

                                                                                                                                                SHA512

                                                                                                                                                1620fbf363150496a9bc87dbf2bf652bccf1d47eb9438b08ec02aecc5d2f360cfcfa9e10bb37ff3ded118e561ace94a5c21ba475e971d35cad197ceb845658af

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.mmc
                                                                                                                                                Filesize

                                                                                                                                                255B

                                                                                                                                                MD5

                                                                                                                                                a0c4d2f989198272c1e2593e65c9c6cb

                                                                                                                                                SHA1

                                                                                                                                                0fa5cf2c05483bb89b611e0de9db674e9d53389c

                                                                                                                                                SHA256

                                                                                                                                                f3170aeec265cc49ff0f5dcb7ed7897371b0f7d1321f823f53b9b0e3a30e1d23

                                                                                                                                                SHA512

                                                                                                                                                209798b5b153283bea29974c1433fe8b6c14f2a54e57237d021ecc1013b8dc6931dedcc2fe173d121c719901045fdf2215177ba164c05d703f2e88a196252ec4

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.mmc
                                                                                                                                                Filesize

                                                                                                                                                149B

                                                                                                                                                MD5

                                                                                                                                                b0ad7e59754e8d953129437b08846b5f

                                                                                                                                                SHA1

                                                                                                                                                9ed0ae9bc497b3aa65aed2130d068c4c1c70d87a

                                                                                                                                                SHA256

                                                                                                                                                cf80455e97e3fede569ea275fa701c0f185eeba64f695286647afe56d29e2c37

                                                                                                                                                SHA512

                                                                                                                                                53e6ce64ad4e9f5696de92a32f65d06dbd459fd12256481706d7e6d677a14c15238e5351f97d2eb7bfb129a0d39f2603c4d14305a86821ed56e9face0bc252b6

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Admin\Desktop\MICROSOFT EDGE.mmc
                                                                                                                                                Filesize

                                                                                                                                                252B

                                                                                                                                                MD5

                                                                                                                                                0b7d6914496973c48637995715d6f0d4

                                                                                                                                                SHA1

                                                                                                                                                9ac88bd5741ea9825e77511ddd35ad454f05bb99

                                                                                                                                                SHA256

                                                                                                                                                9d008d6bf529b562faba50a822eba33df5162e98265362cd23fdf5edfa65a5c8

                                                                                                                                                SHA512

                                                                                                                                                ed15ee3776c0eccc4020e006413ecdcdb13ee796376775e2a7fe9d0d7238b6e7633c665f4a78fa3427d9d6bf4309b35876297db2872c26ba0a945dcfc3faf85a

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Public\Desktop\ACROBAT READER DC.mmc
                                                                                                                                                Filesize

                                                                                                                                                268B

                                                                                                                                                MD5

                                                                                                                                                57b00ccb3a351d6e45df0c5865020169

                                                                                                                                                SHA1

                                                                                                                                                c932af20d06642b4f2f0cb839cded241a90ace3d

                                                                                                                                                SHA256

                                                                                                                                                44771198c83ab0ed544795e6d1141330bc8f62129296e13218ef8422a9eab0d5

                                                                                                                                                SHA512

                                                                                                                                                334bf991e5d942a9e7f428948a93863fcacf1280518e5d1992ce36de0e2b3805195e6eadb1fbb70b6c45b371be9a7245c844231eff7c93a8f9b06b0e30d0f529

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Public\Desktop\FIREFOX.mmc
                                                                                                                                                Filesize

                                                                                                                                                212B

                                                                                                                                                MD5

                                                                                                                                                e738deb26be0ae6ee9ea74b117af48dc

                                                                                                                                                SHA1

                                                                                                                                                44905d91300e06cc6b293dcc5bd6688d9243495b

                                                                                                                                                SHA256

                                                                                                                                                363989f254555ef8fb96df9010ca31c6e2035b10af004aeec341fc2ec26d117d

                                                                                                                                                SHA512

                                                                                                                                                12ee06669dddb6bf1f2da6f4be7beb93e17bd9e8480c119cab1ff4c011ee97680d4de7bd8bef68a0426948b2ffb421c32445387c5ed60f1d140e9ff66f96e867

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Public\Desktop\GOOGLE CHROME.mmc
                                                                                                                                                Filesize

                                                                                                                                                250B

                                                                                                                                                MD5

                                                                                                                                                7dde836318d7cdbeef35f3d06a6d7b6d

                                                                                                                                                SHA1

                                                                                                                                                b26b884a2bd94a432a6e1da3acc5a99dc06c1d42

                                                                                                                                                SHA256

                                                                                                                                                951ba6b01bca3f14eabf9a657497bd172a073984e5a07a6bb39fe4ec8622aaa8

                                                                                                                                                SHA512

                                                                                                                                                74e3154552e693338f587e77a1f01762762406f8a782438ca9041888fb529dec7682692636f1dbd5255cd0922149a3b47c1cad0b3cd782f7f38497526fd945e6

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Public\Desktop\Internet Explorer.mmc
                                                                                                                                                Filesize

                                                                                                                                                218B

                                                                                                                                                MD5

                                                                                                                                                4b9f175d36f729bc91274a478a80f85c

                                                                                                                                                SHA1

                                                                                                                                                7bd79be7dc7fcbe207f16c2aa3fab022a70e7809

                                                                                                                                                SHA256

                                                                                                                                                6533906583c1f768d716d7e9b101d35d1198d9c32a06d882aa626b2e4a51ee02

                                                                                                                                                SHA512

                                                                                                                                                e6ae4ff1cf1ab92cd649ceeda9c59794d8bfd1ca4500f672425d4a74aa48a0e938120d2444a2250513437da04767ff5883e81c7fa5dfa7e71b97bb967c0d5874

                                                                                                                                                Download Submit

                                                                                                                                              • C:\Users\Public\Desktop\VLC MEDIA PLAYER.mmc
                                                                                                                                                Filesize

                                                                                                                                                198B

                                                                                                                                                MD5

                                                                                                                                                05a9ce26830a5d720143fff0263529be

                                                                                                                                                SHA1

                                                                                                                                                1b726387ca0cd48235aa0c72b95a56ba9d43c85e

                                                                                                                                                SHA256

                                                                                                                                                d15d32a3cc4c32b19be8951fd62ccf2fd9e8d40691dee12899a715f0aff298f2

                                                                                                                                                SHA512

                                                                                                                                                89c4fea31b80b5b3e413136c20d3edf81c9c6ecb3725c6025fa3bf7ce505aeec9bb3d269179942db5574dd152808e1d36c58604b093ed74a25049f1b4d98f58f

                                                                                                                                                Download Submit

                                                                                                                                              • memory/464-244-0x0000000004360000-0x0000000004361000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/1060-395-0x0000000004E20000-0x0000000004E21000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/1180-1300-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/1356-699-0x00000000046A0000-0x00000000046A1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/1440-84-0x000001AE768E0000-0x000001AE76900000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/1440-83-0x000001AE762C0000-0x000001AE762E0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/1440-0-0x0000000000400000-0x00000000004B1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                708KB

                                                                                                                                                Download

                                                                                                                                              • memory/1440-58-0x000001AE76300000-0x000001AE76320000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/1440-54-0x000001AE75400000-0x000001AE75500000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1024KB

                                                                                                                                                Download

                                                                                                                                              • memory/1440-38-0x0000000000400000-0x00000000004B1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                708KB

                                                                                                                                                Download

                                                                                                                                              • memory/1484-246-0x0000023BAC500000-0x0000023BAC600000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1024KB

                                                                                                                                                Download

                                                                                                                                              • memory/1484-247-0x0000023BAC500000-0x0000023BAC600000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1024KB

                                                                                                                                                Download

                                                                                                                                              • memory/1484-251-0x0000023BAD5D0000-0x0000023BAD5F0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/1484-279-0x0000023BAD9A0000-0x0000023BAD9C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/1484-271-0x0000023BAD590000-0x0000023BAD5B0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/1840-1004-0x0000000004C80000-0x0000000004C81000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/2100-555-0x0000029099B60000-0x0000029099B80000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/2100-401-0x000001F9832D0000-0x000001F9832F0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/2100-550-0x0000028897A00000-0x0000028897B00000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1024KB

                                                                                                                                                Download

                                                                                                                                              • memory/2100-420-0x000001F9838A0000-0x000001F9838C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/2100-580-0x0000029099B20000-0x0000029099B40000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/2100-588-0x0000029099F20000-0x0000029099F40000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/2100-419-0x000001F983290000-0x000001F9832B0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/2100-396-0x000001F982500000-0x000001F982600000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1024KB

                                                                                                                                                Download

                                                                                                                                              • memory/2100-397-0x000001F982500000-0x000001F982600000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1024KB

                                                                                                                                                Download

                                                                                                                                              • memory/2260-52-0x00000000037B0000-0x00000000037B1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/2440-1156-0x00000000041D0000-0x00000000041D1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/2628-1158-0x000001433D400000-0x000001433D500000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1024KB

                                                                                                                                                Download

                                                                                                                                              • memory/2628-1157-0x000001433D400000-0x000001433D500000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1024KB

                                                                                                                                                Download

                                                                                                                                              • memory/2628-851-0x0000000004450000-0x0000000004451000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download

                                                                                                                                              • memory/2628-1185-0x000001433E910000-0x000001433E930000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/2628-1171-0x000001433E500000-0x000001433E520000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/2628-1163-0x000001433E540000-0x000001433E560000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/4104-1302-0x0000024282500000-0x0000024282600000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1024KB

                                                                                                                                                Download

                                                                                                                                              • memory/4104-1319-0x0000024282FA0000-0x0000024282FC0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/4104-1333-0x00000242838C0000-0x00000242838E0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/4104-1307-0x0000024282FE0000-0x0000024283000000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/4548-701-0x000002147F400000-0x000002147F500000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1024KB

                                                                                                                                                Download

                                                                                                                                              • memory/4548-703-0x000002147F400000-0x000002147F500000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1024KB

                                                                                                                                                Download

                                                                                                                                              • memory/4548-706-0x0000021480540000-0x0000021480560000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/4548-731-0x0000021480900000-0x0000021480920000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/4548-718-0x0000021480500000-0x0000021480520000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/4708-858-0x0000014C44940000-0x0000014C44960000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/4708-882-0x0000014C44D00000-0x0000014C44D20000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/4708-854-0x0000014C43800000-0x0000014C43900000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1024KB

                                                                                                                                                Download

                                                                                                                                              • memory/4708-881-0x0000014C44900000-0x0000014C44920000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/4824-1005-0x0000020D42200000-0x0000020D42300000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1024KB

                                                                                                                                                Download

                                                                                                                                              • memory/4824-1042-0x0000020D43680000-0x0000020D436A0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/4824-1006-0x0000020D42200000-0x0000020D42300000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1024KB

                                                                                                                                                Download

                                                                                                                                              • memory/4824-1023-0x0000020D43270000-0x0000020D43290000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/4824-1010-0x0000020D432B0000-0x0000020D432D0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                128KB

                                                                                                                                                Download

                                                                                                                                              • memory/5044-548-0x0000000002F70000-0x0000000002F71000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                4KB

                                                                                                                                                Download