Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    56s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/07/2024, 08:34

General

  • Target

    5b30734c86e13b3ecf4c464f8c1f1a66_JaffaCakes118.exe

  • Size

    286KB

  • MD5

    5b30734c86e13b3ecf4c464f8c1f1a66

  • SHA1

    d6023ba18d36ab1f3a79e722966cb03a7e02ddff

  • SHA256

    563410ebee67ab9c295168c8d26eff9ea363250c2e8a44066acbe85d14e2ad52

  • SHA512

    e6ec5ffe5e79b63742558a86510d92c5ccc50525c9a6745096e61c0bcd52532ca9d39867c9c83d0ea56765cb5d71cb0def2e5f8da6bee6036186868f6cd250a4

  • SSDEEP

    6144:OVq+UoZyYg4M4crK5XKOKzOVGPwyOV8N0cSCbdJ2rjm:OV2ajbx6pPwPuN0cbb/oi

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables taskbar notifications via registry modification
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 16 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b30734c86e13b3ecf4c464f8c1f1a66_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5b30734c86e13b3ecf4c464f8c1f1a66_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4968
    • C:\Users\Admin\AppData\Local\Temp\5b30734c86e13b3ecf4c464f8c1f1a66_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\5b30734c86e13b3ecf4c464f8c1f1a66_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\769BF\4E3F0.exe%C:\Users\Admin\AppData\Roaming\769BF
      2⤵
        PID:4392
      • C:\Users\Admin\AppData\Local\Temp\5b30734c86e13b3ecf4c464f8c1f1a66_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\5b30734c86e13b3ecf4c464f8c1f1a66_JaffaCakes118.exe startC:\Program Files (x86)\BF9A8\lvvm.exe%C:\Program Files (x86)\BF9A8
        2⤵
          PID:452
        • C:\Program Files (x86)\LP\F027\274A.tmp
          "C:\Program Files (x86)\LP\F027\274A.tmp"
          2⤵
          • Executes dropped EXE
          PID:4016
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2796
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3364
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4772
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3544
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3020
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1604
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4524
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3880
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:3488
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2672
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3052
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:2964
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2556
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3324
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:1032
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1276
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1484
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4032
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4160
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3820
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4480
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:368
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:3956
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:3972
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:3816
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:3840
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:3396
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:1124
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:1004
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:3372
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:1600
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:1492
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:1088
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:1888
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:3656
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:3832
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:4848
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:1424
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:3840
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:2392
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:3192
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:4020
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:2340
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:536
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:1088
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:3088
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:4960
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:4056
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:4816
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:384
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:3744
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:3484
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:1936
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:3292
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:4124
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:4640
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:1744
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:2472
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:1424
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:3104
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:2252
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:2280
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:1068
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:1708
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:2252
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:3084
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:4284
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:3484
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:892
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:3844
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:4744
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:3956
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                            1⤵
                                                                                                              PID:2028
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:3940
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:4504
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                  1⤵
                                                                                                                    PID:3192
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:4100
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                      1⤵
                                                                                                                        PID:384
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                        1⤵
                                                                                                                          PID:2900

                                                                                                                        Network

                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                        Replay Monitor

                                                                                                                        Loading Replay Monitor...

                                                                                                                        Downloads

                                                                                                                        • C:\Program Files (x86)\LP\F027\274A.tmp

                                                                                                                          Filesize

                                                                                                                          101KB

                                                                                                                          MD5

                                                                                                                          c932041a7e800a1a80890dbe7d984243

                                                                                                                          SHA1

                                                                                                                          275e521889eaca58e193a5e7a6675fd08a6b6418

                                                                                                                          SHA256

                                                                                                                          2890d67e3a1b817a45e95fb5d7238c2761fad5a0c9fec3280e1be2c1a00d5c02

                                                                                                                          SHA512

                                                                                                                          b111ade33c5982232722d81f9c1329c3d875aa1be7a8870371cff9eba51390c05d70b9ce680241932463459fb550ded667a702e754a762f88d88e73b850275ef

                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                                                          Filesize

                                                                                                                          471B

                                                                                                                          MD5

                                                                                                                          620fc0dc450746babe32bfa9ce1bbd73

                                                                                                                          SHA1

                                                                                                                          cb8ecc4886d181b4a8f633742d02801e90736c3f

                                                                                                                          SHA256

                                                                                                                          bb2c39fa92f6b55791fb33bcc0b1fc1994d9d4184e2a9eb4311950b528a799ca

                                                                                                                          SHA512

                                                                                                                          1a7593cdf2471beb62655bb31c760422e3bd47dee49c33678b0b8393995a7eae40d923f9f79f02736a321548f202d2839cb3d5b57d4a3ad488953c96b8f52cb4

                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                                                          Filesize

                                                                                                                          420B

                                                                                                                          MD5

                                                                                                                          14e2d5a87cc1bbf8ff328451572f7d19

                                                                                                                          SHA1

                                                                                                                          7729bd7f88fae0802081cdaabd2bdba97b266187

                                                                                                                          SHA256

                                                                                                                          f16dd32704d90bac9083a463012ccf320facbc57bca302f189256f580070d8c6

                                                                                                                          SHA512

                                                                                                                          10f27f58686646f92dd429cedc5717d2849ec8d4a5ded2941a276e54d2c02c53bdff45985725bcbfbbc6ed40668d98f0331ee286dc527d95d201dd188a22decb

                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          3c0c05f01215c5b899a04896ae5263e4

                                                                                                                          SHA1

                                                                                                                          0462d807235e01f1364431d2c222bc8e3a49bd7f

                                                                                                                          SHA256

                                                                                                                          8466b5008f2b76e32469e8d50e3cba432f505ea723ac80fc02b79738f639999f

                                                                                                                          SHA512

                                                                                                                          6707d9ea51889b20c96277388f0fc736f48a693b668f72528d45cbcb826f1e1d70116cc567104948be9fc680e46c2e8d662a4d99c4b95d957a4118f6a253f412

                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15

                                                                                                                          Filesize

                                                                                                                          36KB

                                                                                                                          MD5

                                                                                                                          0e2a09c8b94747fa78ec836b5711c0c0

                                                                                                                          SHA1

                                                                                                                          92495421ad887f27f53784c470884802797025ad

                                                                                                                          SHA256

                                                                                                                          0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                                                                          SHA512

                                                                                                                          61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133658517278565744.txt

                                                                                                                          Filesize

                                                                                                                          74KB

                                                                                                                          MD5

                                                                                                                          38a6c4212d8b05e47ab0f443eaafb77e

                                                                                                                          SHA1

                                                                                                                          bf911f49f6a21816fc723a6bf0c430046b23d3b3

                                                                                                                          SHA256

                                                                                                                          a3f782fe9ed9f0af7ca697f3eb00baa22c1d89b6b9e5d37529e65c5845c97f1b

                                                                                                                          SHA512

                                                                                                                          d8aae1e8bfbaa2d462b0b238b17b02a03cadab11a29a8e2e3e3b2c367d98b12fd2af0d3f009587cc8259972efbb60c2781dc6dfce7261166ac4876b3df07cc9b

                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PD9W9QT7\microsoft.windows[1].xml

                                                                                                                          Filesize

                                                                                                                          97B

                                                                                                                          MD5

                                                                                                                          984c8bc65a898323365141d3407ebc36

                                                                                                                          SHA1

                                                                                                                          835db22513afd4114344a4602a4a494cbbc76413

                                                                                                                          SHA256

                                                                                                                          d69d50e6a4b4b860608940d3b73bcd92c98383eccf57b9e5f933e39dda7a74d1

                                                                                                                          SHA512

                                                                                                                          d416206ea0529d90fc518d1d398059296279e56c1373c8f8e54015dba1b8d485f80533411db5f6f4fab3b410cf7c9b87d4d2f1528d8eb38d5cf7c4896ce5e02a

                                                                                                                        • C:\Users\Admin\AppData\Roaming\769BF\F9A8.69B

                                                                                                                          Filesize

                                                                                                                          600B

                                                                                                                          MD5

                                                                                                                          1e0e7121cb1e680cfeefecf2c351ed39

                                                                                                                          SHA1

                                                                                                                          33cbf2901c0631729abea37155eed05b61d23c1e

                                                                                                                          SHA256

                                                                                                                          ab996ffbaeb016e0062f3e52d776b2c772fc990890af831377b95c27618062fe

                                                                                                                          SHA512

                                                                                                                          5f3832e94451d7caabd7051e9fa9e0ddd23cfa0453082863077dfadaaec6f9c2f01a2163fa49abaaa768214ce11e52b6c13b4f6719340c68c8dae689a9542118

                                                                                                                        • C:\Users\Admin\AppData\Roaming\769BF\F9A8.69B

                                                                                                                          Filesize

                                                                                                                          996B

                                                                                                                          MD5

                                                                                                                          a6f0e5af0ede426e2a3f8095b1bd0475

                                                                                                                          SHA1

                                                                                                                          b13e718d06830efb632318ccd02e192a2e0830b7

                                                                                                                          SHA256

                                                                                                                          e7864f076e7e495cf973b2f59b0e732aedd58eac2bfdfdc7e2b674e2ee4c0618

                                                                                                                          SHA512

                                                                                                                          6f515a29e9c47c777b03a00e95e37f35e4b347b3bff77212659419bcc88108fb7cd96e06ad882c38c1b9bddc66f91710375038dc9dea641ad68aa91bddb504c9

                                                                                                                        • C:\Users\Admin\AppData\Roaming\769BF\F9A8.69B

                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          030fde2dc354105efaaf9d6d2844a4e3

                                                                                                                          SHA1

                                                                                                                          b03c66c16512462f4a8221b4a7e18fb05e1d62e9

                                                                                                                          SHA256

                                                                                                                          219116e381ddc66816906a463d630d6ef9d84dd59e044416f0f89acfbd078796

                                                                                                                          SHA512

                                                                                                                          2c4606987c2f3ce8edd99b22298fc888124c41d472d9ed5773591e46ab19d317750e01a1061906e50c0a3f13578dc7f0cc0411936150af963e368c671a79486b

                                                                                                                        • memory/452-141-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          416KB

                                                                                                                        • memory/452-140-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          424KB

                                                                                                                        • memory/452-954-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          424KB

                                                                                                                        • memory/1004-1401-0x000001685CB00000-0x000001685CC00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/1004-1433-0x000001685DFE0000-0x000001685E000000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/1004-1405-0x000001685DC10000-0x000001685DC30000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/1004-1400-0x000001685CB00000-0x000001685CC00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/1004-1417-0x000001685DBD0000-0x000001685DBF0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/1032-807-0x0000000004150000-0x0000000004151000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/1484-829-0x000002AA20670000-0x000002AA20690000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/1484-814-0x000002AA206B0000-0x000002AA206D0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/1484-841-0x000002AA20C80000-0x000002AA20CA0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/1484-809-0x000002AA1F750000-0x000002AA1F850000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/1484-810-0x000002AA1F750000-0x000002AA1F850000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/1604-320-0x0000000003780000-0x0000000003781000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2964-655-0x0000000003630000-0x0000000003631000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/3052-503-0x00000152B7600000-0x00000152B7700000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/3052-506-0x00000152B8700000-0x00000152B8720000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3052-530-0x00000152B8AD0000-0x00000152B8AF0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3052-518-0x00000152B86C0000-0x00000152B86E0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3324-674-0x00000218D02C0000-0x00000218D02E0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3324-658-0x00000218CF400000-0x00000218CF500000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/3324-659-0x00000218CF400000-0x00000218CF500000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/3324-662-0x00000218D0300000-0x00000218D0320000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3324-657-0x00000218CF400000-0x00000218CF500000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/3324-685-0x00000218D08E0000-0x00000218D0900000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3372-1540-0x0000000004220000-0x0000000004221000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/3396-1398-0x00000000045B0000-0x00000000045B1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/3488-499-0x0000000004710000-0x0000000004711000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/3820-963-0x0000021DB1F90000-0x0000021DB1FB0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3820-995-0x0000021DB2360000-0x0000021DB2380000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3820-975-0x0000021DB1F50000-0x0000021DB1F70000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3820-958-0x00000215AFE40000-0x00000215AFF40000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/3820-959-0x00000215AFE40000-0x00000215AFF40000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/3840-1256-0x000001DFC8FC0000-0x000001DFC8FE0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3840-1268-0x000001DFC8F80000-0x000001DFC8FA0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3840-1279-0x000001DFC9390000-0x000001DFC93B0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3840-1251-0x000001D7C6F00000-0x000001D7C7000000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/3880-327-0x000002800A8A0000-0x000002800A8C0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3880-324-0x0000028009740000-0x0000028009840000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/3880-323-0x0000028009740000-0x0000028009840000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/3880-322-0x0000028009740000-0x0000028009840000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/3880-355-0x000002800AC70000-0x000002800AC90000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3880-341-0x000002800A860000-0x000002800A880000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3956-1125-0x000001ECCE580000-0x000001ECCE5A0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3956-1144-0x000001ECCE990000-0x000001ECCE9B0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3956-1107-0x000001ECCD300000-0x000001ECCD400000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/3956-1108-0x000001ECCD300000-0x000001ECCD400000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/3956-1112-0x000001ECCE5C0000-0x000001ECCE5E0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3972-1249-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/4016-647-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          112KB

                                                                                                                        • memory/4032-956-0x0000000004420000-0x0000000004421000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/4392-13-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          424KB

                                                                                                                        • memory/4480-1106-0x0000000002B70000-0x0000000002B71000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/4968-653-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          424KB

                                                                                                                        • memory/4968-138-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          416KB

                                                                                                                        • memory/4968-137-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          424KB

                                                                                                                        • memory/4968-2-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          424KB

                                                                                                                        • memory/4968-11-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          424KB

                                                                                                                        • memory/4968-1-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          416KB