Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    60s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/07/2024, 07:52

General

  • Target

    6ad0243cfdf2ac9af48599af491f80b3_JaffaCakes118.exe

  • Size

    286KB

  • MD5

    6ad0243cfdf2ac9af48599af491f80b3

  • SHA1

    8de16279befa53713e825aa28e6352d7d90c9d07

  • SHA256

    723d583a002776758a2852cfe94bfc798b3a346fdf340a463e4677a8f8dbf454

  • SHA512

    8f45e82bb5d04e8adaf1e70c8e6a31782d8695ba606c43d76132c759665f405b7922008f5a14d4817fcd912039a343cf4b609b1c6850df7fdc1f0cfa9733cf6c

  • SSDEEP

    6144:jL8wlciVX7xX2zuXfsxpJUVMNjNAh95cJSPBqQP:jIfgp25xbUV8AhncJSPBqQ

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables taskbar notifications via registry modification
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 18 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ad0243cfdf2ac9af48599af491f80b3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6ad0243cfdf2ac9af48599af491f80b3_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1952
    • C:\Users\Admin\AppData\Local\Temp\6ad0243cfdf2ac9af48599af491f80b3_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\6ad0243cfdf2ac9af48599af491f80b3_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\FFF6E\C91A6.exe%C:\Users\Admin\AppData\Roaming\FFF6E
      2⤵
        PID:4440
      • C:\Users\Admin\AppData\Local\Temp\6ad0243cfdf2ac9af48599af491f80b3_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\6ad0243cfdf2ac9af48599af491f80b3_JaffaCakes118.exe startC:\Program Files (x86)\6E40D\lvvm.exe%C:\Program Files (x86)\6E40D
        2⤵
          PID:1980
        • C:\Program Files (x86)\LP\A66F\1316.tmp
          "C:\Program Files (x86)\LP\A66F\1316.tmp"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4036
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4740
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4888
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3348
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4532
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:536
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:184
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4120
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4508
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:2528
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4528
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4080
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:2324
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2608
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2096
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:3800
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3676
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3132
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:2028
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4080
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4896
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4248
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2584
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3644
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4748
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4872
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:940
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:4216
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:2868
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:4976
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:3760
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:4908
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:4528
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:1696
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:4084
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:2240
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:1212
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:1216
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:3528
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:1820
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:3288
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:808
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:2984
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:4032
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:2324
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:1304
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:3060
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:3164
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:1220
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:4008
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:4540
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:2112
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:5112
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:2128
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:1688
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:4648
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:3560
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:1928
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:3276
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:1768
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:940
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:3892
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:3852
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:2264
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:184
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:808
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:3924
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:4176
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:1188
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:1616
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:4716
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:4808
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:4944
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:2676
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                          PID:376
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                            PID:1108
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:1820
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:2240
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                1⤵
                                                                                                                  PID:608
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:2936
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                    1⤵
                                                                                                                      PID:996
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                      1⤵
                                                                                                                        PID:1424
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        explorer.exe
                                                                                                                        1⤵
                                                                                                                          PID:1624

                                                                                                                        Network

                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                        Replay Monitor

                                                                                                                        Loading Replay Monitor...

                                                                                                                        Downloads

                                                                                                                        • C:\Program Files (x86)\LP\A66F\1316.tmp

                                                                                                                          Filesize

                                                                                                                          102KB

                                                                                                                          MD5

                                                                                                                          9636b8b316a3bc776f9a98ea09da5caf

                                                                                                                          SHA1

                                                                                                                          050f0bc24149a2e208fdec8e0d7bdb08133ff958

                                                                                                                          SHA256

                                                                                                                          2de935d69a83a276edbd20ee616e8ece2a2ec3aa75daebd91de5891a099e3a4f

                                                                                                                          SHA512

                                                                                                                          472bc6565f724a356938412a0dac7c443c2e45b71101831542b6723f6bcee9d3d54afc40adec603db829d736c828d60c08b0a3a78e1f691bdbff8445c424e8a0

                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                                                          Filesize

                                                                                                                          471B

                                                                                                                          MD5

                                                                                                                          94351cb105884b824e9778d0dded1c64

                                                                                                                          SHA1

                                                                                                                          f950bfaf7329f27b9a8d08c6b7aa511e151cc852

                                                                                                                          SHA256

                                                                                                                          b67fd799051ec989f549f50ebe37d5eb7a81ad311e0017806d93a138eb4525ef

                                                                                                                          SHA512

                                                                                                                          fdf20b838cb3300c4da8f5cf7f934d4dcc4ccf6f55310d584e3478075e1ad8c6de3496da14256c45158691f490141b30c43680f14312e89251b0440cdcccef28

                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                                                          Filesize

                                                                                                                          420B

                                                                                                                          MD5

                                                                                                                          b9136547a55b34b060970d3f7f65d128

                                                                                                                          SHA1

                                                                                                                          abdfa8102112f84b2dcc3a5ffd9107757c2fbd1b

                                                                                                                          SHA256

                                                                                                                          697fee011d75023c48834173094ebe8a6b23fe4b367cf04ac8e7f22b8e22da3a

                                                                                                                          SHA512

                                                                                                                          ae8866f0d58b4dd91e9cbe5187b06941d400cbfa6490de11d58d8240db641584b1aa34466797b885f8e9328b704a5a81d6974ede8da62c337b587f101d1e94aa

                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          792c9633de5b4ffb0f1667df15a86a97

                                                                                                                          SHA1

                                                                                                                          7bcfec3c8e136ee0aa2a3efcc070964f049df7e4

                                                                                                                          SHA256

                                                                                                                          dc810f6af07bfa354d088e914ea79bd9671fda35540b6a8cee5deaee6c651d10

                                                                                                                          SHA512

                                                                                                                          ec6f4a872189ed8855ba3d950bb3695d400687a15266080b557a38c59c01e218144ea385f9e67821b996a5b70bfa13581fa616f5c7ef7649f945e4939e5b9bc6

                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel

                                                                                                                          Filesize

                                                                                                                          36KB

                                                                                                                          MD5

                                                                                                                          fb5f8866e1f4c9c1c7f4d377934ff4b2

                                                                                                                          SHA1

                                                                                                                          d0a329e387fb7bcba205364938417a67dbb4118a

                                                                                                                          SHA256

                                                                                                                          1649ec9493be27f76ae7304927d383f8a53dd3e41ea1678bacaff33120ea4170

                                                                                                                          SHA512

                                                                                                                          0fbe2843dfeab7373cde0643b20c073fdc2fcbefc5ae581fd1656c253dfa94e8bba4d348e95cc40d1e872456ecca894b462860aeac8b92cedb11a7cad634798c

                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_help

                                                                                                                          Filesize

                                                                                                                          36KB

                                                                                                                          MD5

                                                                                                                          8aaad0f4eb7d3c65f81c6e6b496ba889

                                                                                                                          SHA1

                                                                                                                          231237a501b9433c292991e4ec200b25c1589050

                                                                                                                          SHA256

                                                                                                                          813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1

                                                                                                                          SHA512

                                                                                                                          1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62

                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133662811952177719.txt

                                                                                                                          Filesize

                                                                                                                          75KB

                                                                                                                          MD5

                                                                                                                          23ec511c348aae6c5a9d32c06013b9fc

                                                                                                                          SHA1

                                                                                                                          8423adf1282728ced6899c58ece2552cb0b9333f

                                                                                                                          SHA256

                                                                                                                          e704709fd0d6d6e52bc6c08b1352bc2dbbb8bca5a475a153bc483147e411eb57

                                                                                                                          SHA512

                                                                                                                          fee47d15f2f33810c56e80ea1dcd124cdf53f8bd30818f1ee83db3188266af5a03961470ca5d3a82c03bfc956cdf001bc2f1395928950f60a2ed336c086ab2d0

                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7M5I75JN\microsoft.windows[1].xml

                                                                                                                          Filesize

                                                                                                                          97B

                                                                                                                          MD5

                                                                                                                          859ab69c110b39b89cf12fa8ec848a60

                                                                                                                          SHA1

                                                                                                                          115751d92448bb0fd75a162938226fb6b0b30ede

                                                                                                                          SHA256

                                                                                                                          a8feaf799158198356b15e70ab778bfaa95fc80817477d15e355e67a6efc7c5a

                                                                                                                          SHA512

                                                                                                                          6ee7e9cd4d7e53ff6f31eba404a1782a9a0fe524b5aefb3fbf556d56fb70cd036204dd4b46bd87aec3ecd165f4bcfc10742d9cce6665b9e90a4f96723831c989

                                                                                                                        • C:\Users\Admin\AppData\Roaming\FFF6E\E40D.FF6

                                                                                                                          Filesize

                                                                                                                          996B

                                                                                                                          MD5

                                                                                                                          a54704ec71d070b8ae17f9c0a09b70a1

                                                                                                                          SHA1

                                                                                                                          dc5872ff218a783c164a5288ec40f0884069cf39

                                                                                                                          SHA256

                                                                                                                          0963e8e7471a41465048655d8949197adf2396502591e3e79c2e196726392e1f

                                                                                                                          SHA512

                                                                                                                          3f9051cd90b5dfeba7845e89adb013cb7a271b5cde7821c0d1365ab4c0e64e68b43ce3574064982acfed5402ae81e48d4447a30d0dc58426c738a7e8f966853f

                                                                                                                        • C:\Users\Admin\AppData\Roaming\FFF6E\E40D.FF6

                                                                                                                          Filesize

                                                                                                                          600B

                                                                                                                          MD5

                                                                                                                          bacf79cf00bad0ad2cd161d2f4d52f0c

                                                                                                                          SHA1

                                                                                                                          137ad413d5eacb2dcbb061a4c3ec53c9a23914aa

                                                                                                                          SHA256

                                                                                                                          949efd9dd786bb66daf8c518c17d83c02e07edc1748a80270a138b40f03b907e

                                                                                                                          SHA512

                                                                                                                          f9dad62af271657601c95b52a756cc2a0f37610bd192139cd2c2c310f8c54d2c3c4bb9bdc54858dc8f988068b52e1999d0e52f313a3c765cdb95ad727e207180

                                                                                                                        • C:\Users\Admin\AppData\Roaming\FFF6E\E40D.FF6

                                                                                                                          Filesize

                                                                                                                          1KB

                                                                                                                          MD5

                                                                                                                          b0776562ce54438101f80cc77b92198a

                                                                                                                          SHA1

                                                                                                                          7c22519f2b0ea8130d20ad5c689dd18a8ae1b390

                                                                                                                          SHA256

                                                                                                                          b69d8e02cb60ce4daf4cd11eb0a2a4ecc09e65979bafa417b91665cc82a118cd

                                                                                                                          SHA512

                                                                                                                          0a22dfcf5077c9262e73c91da740ca4e38e625aa9ef41da8c1a6a1a6efa7afde96fd46ef1401e40bcffa2560fe2fe9eb434252df01bab7d8f0e909117a014349

                                                                                                                        • C:\Users\Admin\AppData\Roaming\FFF6E\E40D.FF6

                                                                                                                          Filesize

                                                                                                                          300B

                                                                                                                          MD5

                                                                                                                          53fdce166b50510778af5c61e2f2a4da

                                                                                                                          SHA1

                                                                                                                          3e8b8fc56c2f62dc2680639598b0152a8cd75df7

                                                                                                                          SHA256

                                                                                                                          5659dc7b7e67b176fe10ce15492174c7b8ea3ae55155532950829f69ce746f2b

                                                                                                                          SHA512

                                                                                                                          ce65a3ae2369dd58d0817ff4905bb1e4994e2f08de75591ef383025307956d0498aeed03df941b990e9fc59a4216484817ada452576d2914906fcf870646cd95

                                                                                                                        • memory/184-318-0x0000000004360000-0x0000000004361000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/940-1227-0x000001A223FB0000-0x000001A223FD0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/940-1210-0x000001A223190000-0x000001A223290000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/940-1211-0x000001A223190000-0x000001A223290000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/940-1215-0x000001A224300000-0x000001A224320000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/940-1238-0x000001A2246C0000-0x000001A2246E0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/1952-126-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          428KB

                                                                                                                        • memory/1952-12-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          428KB

                                                                                                                        • memory/1952-647-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          428KB

                                                                                                                        • memory/1952-2-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          428KB

                                                                                                                        • memory/1952-1-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          416KB

                                                                                                                        • memory/1952-190-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          416KB

                                                                                                                        • memory/1980-128-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          428KB

                                                                                                                        • memory/1980-129-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          416KB

                                                                                                                        • memory/1980-130-0x0000000000751000-0x0000000000797000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          280KB

                                                                                                                        • memory/2028-921-0x0000000004100000-0x0000000004101000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2096-679-0x0000020A65DC0000-0x0000020A65DE0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/2096-667-0x0000020A659B0000-0x0000020A659D0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/2096-651-0x0000020A64700000-0x0000020A64800000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/2096-656-0x0000020A659F0000-0x0000020A65A10000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/2324-648-0x0000000003F70000-0x0000000003F71000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2528-498-0x0000000004190000-0x0000000004191000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/3132-791-0x000001C9E3A00000-0x000001C9E3B00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/3132-794-0x000001C9E4B40000-0x000001C9E4B60000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3132-789-0x000001C9E3A00000-0x000001C9E3B00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/3132-790-0x000001C9E3A00000-0x000001C9E3B00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/3132-816-0x000001C9E4F10000-0x000001C9E4F30000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3132-804-0x000001C9E4B00000-0x000001C9E4B20000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3644-1073-0x0000024022200000-0x0000024022300000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/3644-1079-0x0000024022FB0000-0x0000024022FD0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3644-1080-0x00000240236C0000-0x00000240236E0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3644-1077-0x0000024023300000-0x0000024023320000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/3644-1072-0x0000024022200000-0x0000024022300000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/3800-787-0x0000000004980000-0x0000000004981000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/4036-650-0x0000000000400000-0x000000000041D000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          116KB

                                                                                                                        • memory/4080-514-0x0000018324AD0000-0x0000018324AF0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/4080-528-0x00000183250E0000-0x0000018325100000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/4080-499-0x0000018323C00000-0x0000018323D00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/4080-504-0x0000018324B10000-0x0000018324B30000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/4216-1355-0x0000000004030000-0x0000000004031000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/4248-1070-0x0000000004590000-0x0000000004591000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/4440-13-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          428KB

                                                                                                                        • memory/4440-14-0x0000000000681000-0x00000000006C7000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          280KB

                                                                                                                        • memory/4508-322-0x00000219DE220000-0x00000219DE320000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/4508-321-0x00000219DE220000-0x00000219DE320000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/4508-356-0x00000219DF750000-0x00000219DF770000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/4508-335-0x00000219DF340000-0x00000219DF360000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/4508-320-0x00000219DE220000-0x00000219DE320000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/4508-325-0x00000219DF380000-0x00000219DF3A0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/4748-1208-0x00000000027F0000-0x00000000027F1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/4896-923-0x00000205F8600000-0x00000205F8700000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/4896-960-0x00000205F9B10000-0x00000205F9B30000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/4896-929-0x00000205F9740000-0x00000205F9760000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/4896-940-0x00000205F9700000-0x00000205F9720000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/4976-1356-0x0000011E1E500000-0x0000011E1E600000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/4976-1357-0x0000011E1E500000-0x0000011E1E600000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1024KB

                                                                                                                        • memory/4976-1361-0x0000011E1F5E0000-0x0000011E1F600000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/4976-1364-0x0000011E1F5A0000-0x0000011E1F5C0000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB