Overview

overview

8

Static

static

3

6a4add9a4f...18.exe

windows7-x64

8

6a4add9a4f...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    41s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/07/2024, 04:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    6a4add9a4f25b3693f2395ccc866e6dd_JaffaCakes118.exe

  • Size

    115KB

  • MD5

    6a4add9a4f25b3693f2395ccc866e6dd

  • SHA1

    8d0f6f8e3d4850ffc2156ad18a347282ca1c0915

  • SHA256

    4be976fc6a7aa0b707546a1e859fdb3da7de82f23ed805d980d22ae9bbc42697

  • SHA512

    8fe35d56f6cc2abb1e741e077490ca8ee605b9d50037f5a7c702c38ef9a72f4db98aeac613a6a5725320cb9b21f95770e4760d0a921ff45455e30257b42e8a7e

  • SSDEEP

    3072:a49WjvJgLYkrO5JBsFaOLfLc2P67LSBnDx7FX8LwJM:aekvJCYuO9SaOLTcZLc975tM

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 16 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a4add9a4f25b3693f2395ccc866e6dd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6a4add9a4f25b3693f2395ccc866e6dd_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3972
    • C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2284
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1316
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\scanner.txt
      2⤵
      • System Location Discovery: System Language Discovery
      • Opens file in notepad (likely ransom note)
      PID:1204
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4280
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:508
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:764
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4276
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1332
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4828
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of SendNotifyMessage
    PID:2596
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4956
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2740
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1404
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1128
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2384
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4992
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2208
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4388
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1448
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2904
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2456
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3344
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4028
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3712
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:4984
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:3836
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:1824
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:1636
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:3896
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:4416
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:1668
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:3244
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:4536
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:772
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:1912
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:4160
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:3228
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:2004
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:2384
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4124
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:2612
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:3292
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:1148
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:3728
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:116
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:1664
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:4632
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:4588
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4568
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:4544
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:676
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3228
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:3292
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:1508
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:4568
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:4148
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:3784
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:2892
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:1488
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:2576
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:3272
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:3624
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:4928
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:3920
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:672
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:2892
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:1128
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:3160
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:2644
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:4008
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:4208
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:4192
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:2644
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:976
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:5016
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:3728
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:4504
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                            1⤵
                                                                                                              PID:3336
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:660
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:5016
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                  1⤵
                                                                                                                    PID:2616
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:4760
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                      1⤵
                                                                                                                        PID:2848
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                        1⤵
                                                                                                                          PID:5104
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe
                                                                                                                          1⤵
                                                                                                                            PID:8
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                            1⤵
                                                                                                                              PID:1944
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                              1⤵
                                                                                                                                PID:4280
                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                explorer.exe
                                                                                                                                1⤵
                                                                                                                                  PID:1308
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:3828
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:4816

                                                                                                                                    Network

                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                          Replay Monitor

                                                                                                                                          Loading Replay Monitor...

                                                                                                                                          Downloads

                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                                                            Filesize

                                                                                                                                            471B

                                                                                                                                            MD5

                                                                                                                                            94351cb105884b824e9778d0dded1c64

                                                                                                                                            SHA1

                                                                                                                                            f950bfaf7329f27b9a8d08c6b7aa511e151cc852

                                                                                                                                            SHA256

                                                                                                                                            b67fd799051ec989f549f50ebe37d5eb7a81ad311e0017806d93a138eb4525ef

                                                                                                                                            SHA512

                                                                                                                                            fdf20b838cb3300c4da8f5cf7f934d4dcc4ccf6f55310d584e3478075e1ad8c6de3496da14256c45158691f490141b30c43680f14312e89251b0440cdcccef28

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                                                            Filesize

                                                                                                                                            420B

                                                                                                                                            MD5

                                                                                                                                            d66d7495b78ea8de5d20e8a2886eb3d6

                                                                                                                                            SHA1

                                                                                                                                            ef0b66c5363faad7c624d7410b60934f1d7de2f4

                                                                                                                                            SHA256

                                                                                                                                            4c6476a190f7210fc512a0dff4df2e43112b614a9eccf12dc111ee10cf7f4fc5

                                                                                                                                            SHA512

                                                                                                                                            5a07ab15c01549c5c7113800052d7c5997054714ce15a75d396d48008b562260883830528b9a6709ad46a20c184e561d9d0b32d202586383bd5053c0254ddb68

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                                            Filesize

                                                                                                                                            2KB

                                                                                                                                            MD5

                                                                                                                                            22ada327400f00f938c45b4963452cf4

                                                                                                                                            SHA1

                                                                                                                                            ad2f27e426c333401597046c25ea4b9ac19f7623

                                                                                                                                            SHA256

                                                                                                                                            6b69557b4ba88157392aab0dcc920e326e62a1fa4e8861b340b3dfe6e2834281

                                                                                                                                            SHA512

                                                                                                                                            811dc9014a27ca9e2e532cf654d8a5c95e82e61f8be63018123d0de681caad48254da0444460ce1b61046b484be6d548fce12f693e10595af849471c8cd1a6dd

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
                                                                                                                                            Filesize

                                                                                                                                            36KB

                                                                                                                                            MD5

                                                                                                                                            0e2a09c8b94747fa78ec836b5711c0c0

                                                                                                                                            SHA1

                                                                                                                                            92495421ad887f27f53784c470884802797025ad

                                                                                                                                            SHA256

                                                                                                                                            0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                                                                                            SHA512

                                                                                                                                            61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
                                                                                                                                            Filesize

                                                                                                                                            36KB

                                                                                                                                            MD5

                                                                                                                                            ab0262f72142aab53d5402e6d0cb5d24

                                                                                                                                            SHA1

                                                                                                                                            eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                                                                                            SHA256

                                                                                                                                            20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                                                                                            SHA512

                                                                                                                                            bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133662700282789636.txt
                                                                                                                                            Filesize

                                                                                                                                            75KB

                                                                                                                                            MD5

                                                                                                                                            2e725c1a7b2927ed8a5426de4c1ca2e4

                                                                                                                                            SHA1

                                                                                                                                            07b499ad3b74a6b670a1470bb5c71d9166c06455

                                                                                                                                            SHA256

                                                                                                                                            93012e2776a467857aaa06db1d344d0dd1066d526890ae7434ddde9a7a12424e

                                                                                                                                            SHA512

                                                                                                                                            c33ad69a1fb4d6d7acce599735ef4ee715cad20a609ce75317572cd61a58afffa68278bbea048e13fe44efbcc0f90501dff58affdf1ca342f7161f123a3f6431

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\F2CLGW5Q\microsoft.windows[1].xml
                                                                                                                                            Filesize

                                                                                                                                            97B

                                                                                                                                            MD5

                                                                                                                                            4a191d9fedda995f5909efbcfcb7027f

                                                                                                                                            SHA1

                                                                                                                                            22c748a1c01c2d69a6c742b4aae9d41703a4c960

                                                                                                                                            SHA256

                                                                                                                                            c7edba1e760f5de63d096bb30b059fe19b90fbbc65f677e0d2facf77271a79e7

                                                                                                                                            SHA512

                                                                                                                                            1162b6872f60e051c569b0b6c8d41bb49be3130373c62ce39bc83c698f5f9a99f75810bccfd7137f831463cbfaf5cd6f13b59d384de334ae1ad58a4c426b162c

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\scanner.txt
                                                                                                                                            Filesize

                                                                                                                                            215B

                                                                                                                                            MD5

                                                                                                                                            756125b673ac39930f3d4cdb75111167

                                                                                                                                            SHA1

                                                                                                                                            4da42eee41dcfed1d2e30c5ed266bf0cc100c43a

                                                                                                                                            SHA256

                                                                                                                                            71abf97b3bb7149a4bc577d3a7270eb3c220d93dd187dc8eb796b413c3c2db1e

                                                                                                                                            SHA512

                                                                                                                                            ba20083e0eca952cf6379946fba3a270350e8e13160e850f3ae0287a9716215681e52956537bf27c3892ca2641ceed6476a14bf566086e52cf7bb458602d30d8

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                                                                                            Filesize

                                                                                                                                            107KB

                                                                                                                                            MD5

                                                                                                                                            aadaa3ff47abb7cd3d40da29a7fe17c5

                                                                                                                                            SHA1

                                                                                                                                            d8b8beac1bcd402d1c542b3f550ffaa47afa1137

                                                                                                                                            SHA256

                                                                                                                                            36c0c2c8d5ab3fe75de3e59d8b8bb03c059ad7265450f9e824e77c0810c237ac

                                                                                                                                            SHA512

                                                                                                                                            0db002e07bf6c38e9f09d63d3277b20e2723466a1e42f4b5c8f7aeecf4ee0e110b51ae092c3dc53dba4b0ebc3d316a6798699fd1d6a0e1997c835743c14c999e

                                                                                                                                            Download Submit

                                                                                                                                          • C:\Windows\LINKINFO.dll
                                                                                                                                            Filesize

                                                                                                                                            13KB

                                                                                                                                            MD5

                                                                                                                                            1387ce50932aa43e069f3dd078152853

                                                                                                                                            SHA1

                                                                                                                                            2842272cff673d0bbaedb7eaac64eec798b7a5d6

                                                                                                                                            SHA256

                                                                                                                                            49b5ebdb5244ed62c0ea91822e8faedab799edd85e00aa5119354a6946f208cb

                                                                                                                                            SHA512

                                                                                                                                            13985d501e75ed2b718c7f9ed3ecee239628495d1e8017c147c4447cb489da290526eca709acb8236a4991854ab41ecd62970077fc1f84926dbee3ae4995b698

                                                                                                                                            Download Submit

                                                                                                                                          • memory/772-1369-0x0000000004820000-0x0000000004821000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1404-334-0x0000000004540000-0x0000000004541000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1448-621-0x00000000046F0000-0x00000000046F1000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1636-1070-0x0000000004920000-0x0000000004921000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1668-1220-0x0000000004D80000-0x0000000004D81000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/1824-948-0x000001D3B4570000-0x000001D3B4590000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/1824-924-0x000001D3B3040000-0x000001D3B3140000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1024KB

                                                                                                                                            Download

                                                                                                                                          • memory/1824-937-0x000001D3B4160000-0x000001D3B4180000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/1824-929-0x000001D3B41A0000-0x000001D3B41C0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/1824-926-0x000001D3B3040000-0x000001D3B3140000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1024KB

                                                                                                                                            Download

                                                                                                                                          • memory/1824-925-0x000001D3B3040000-0x000001D3B3140000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1024KB

                                                                                                                                            Download

                                                                                                                                          • memory/2284-8-0x0000000000400000-0x0000000000421000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            132KB

                                                                                                                                            Download

                                                                                                                                          • memory/2384-1528-0x0000029A9DFA0000-0x0000029A9DFC0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/2384-342-0x0000024DE2490000-0x0000024DE24B0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/2384-367-0x0000024DE2450000-0x0000024DE2470000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/2384-373-0x0000024DE2A60000-0x0000024DE2A80000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/2456-628-0x000002DD32DD0000-0x000002DD32DF0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/2456-624-0x000002DD31D00000-0x000002DD31E00000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1024KB

                                                                                                                                            Download

                                                                                                                                          • memory/2456-660-0x000002DD331A0000-0x000002DD331C0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/2456-623-0x000002DD31D00000-0x000002DD31E00000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1024KB

                                                                                                                                            Download

                                                                                                                                          • memory/2456-637-0x000002DD32D90000-0x000002DD32DB0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/2596-191-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/2740-210-0x000001B7085E0000-0x000001B708600000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/2740-193-0x000001B7074E0000-0x000001B7075E0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1024KB

                                                                                                                                            Download

                                                                                                                                          • memory/2740-195-0x000001B7074E0000-0x000001B7075E0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1024KB

                                                                                                                                            Download

                                                                                                                                          • memory/2740-221-0x000001B708BF0000-0x000001B708C10000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/2740-198-0x000001B708820000-0x000001B708840000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/2740-194-0x000001B7074E0000-0x000001B7075E0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1024KB

                                                                                                                                            Download

                                                                                                                                          • memory/3228-1521-0x0000000004760000-0x0000000004761000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/3344-771-0x00000000047A0000-0x00000000047A1000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/3712-773-0x0000023FDBA00000-0x0000023FDBB00000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1024KB

                                                                                                                                            Download

                                                                                                                                          • memory/3712-777-0x0000023FDCB00000-0x0000023FDCB20000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/3712-772-0x0000023FDBA00000-0x0000023FDBB00000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1024KB

                                                                                                                                            Download

                                                                                                                                          • memory/3712-800-0x0000023FDCED0000-0x0000023FDCEF0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/3712-789-0x0000023FDCAC0000-0x0000023FDCAE0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/4160-1372-0x0000023C85700000-0x0000023C85800000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1024KB

                                                                                                                                            Download

                                                                                                                                          • memory/4160-1388-0x0000023C864E0000-0x0000023C86500000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/4160-1407-0x0000023C86B00000-0x0000023C86B20000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/4160-1370-0x0000023C85700000-0x0000023C85800000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1024KB

                                                                                                                                            Download

                                                                                                                                          • memory/4160-1375-0x0000023C86520000-0x0000023C86540000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/4160-1371-0x0000023C85700000-0x0000023C85800000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1024KB

                                                                                                                                            Download

                                                                                                                                          • memory/4276-21-0x0000000003200000-0x0000000003201000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/4388-485-0x000001CBFBA00000-0x000001CBFBB00000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1024KB

                                                                                                                                            Download

                                                                                                                                          • memory/4388-499-0x000001CBFC8C0000-0x000001CBFC8E0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/4388-489-0x000001CBFC900000-0x000001CBFC920000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/4388-486-0x000001CBFBA00000-0x000001CBFBB00000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1024KB

                                                                                                                                            Download

                                                                                                                                          • memory/4388-484-0x000001CBFBA00000-0x000001CBFBB00000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1024KB

                                                                                                                                            Download

                                                                                                                                          • memory/4388-512-0x000001CBFCEE0000-0x000001CBFCF00000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/4416-1077-0x0000020DF2500000-0x0000020DF2520000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/4416-1089-0x0000020DF24C0000-0x0000020DF24E0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/4416-1108-0x0000020DF2AE0000-0x0000020DF2B00000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/4536-1258-0x000002785CB00000-0x000002785CB20000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/4536-1240-0x000002785C4F0000-0x000002785C510000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/4536-1227-0x000002785C530000-0x000002785C550000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/4828-39-0x00000251BA170000-0x00000251BA190000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/4828-53-0x00000251BA580000-0x00000251BA5A0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/4828-23-0x00000251B9050000-0x00000251B9150000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            1024KB

                                                                                                                                            Download

                                                                                                                                          • memory/4828-27-0x00000251BA1B0000-0x00000251BA1D0000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            128KB

                                                                                                                                            Download

                                                                                                                                          • memory/4984-922-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download

                                                                                                                                          • memory/4992-482-0x0000000004140000-0x0000000004141000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            4KB

                                                                                                                                            Download