Analysis

  • max time kernel
    149s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/09/2024, 19:26 UTC

General

  • Target

    e9d241d83d6df24d69f9c72fad13cc9f_JaffaCakes118.exe

  • Size

    388KB

  • MD5

    e9d241d83d6df24d69f9c72fad13cc9f

  • SHA1

    2607b9d33f9c1425b2b0480c0f9c4e591f6ad5e7

  • SHA256

    3313b765b69555465d780c6a446ad9254c8f69d978553ea960076223f7963a97

  • SHA512

    ce234473ce0071e205c32d8b5cc97b6607a7cbe9d54bddb4b1a131ce63878145b3b3ae97f33bfab28c56307d8ad9f4ac772616e1ba5fe6a468578d148335ef10

  • SSDEEP

    1536:Tkf1zwQVg/8WuREUlOQnF7TkkYSDY6ep5f1zwQVgvXg6Y+:Y1zwL/8WuREcnFEkYSYpJ1zwLvX

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e9d241d83d6df24d69f9c72fad13cc9f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e9d241d83d6df24d69f9c72fad13cc9f_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3696
    • C:\Windows\userinit.exe
      C:\Windows\userinit.exe
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1048
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1428
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4528
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1792
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:852
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1852
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1736
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4812
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1140
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3792
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1856
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3964
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3808
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:452
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3912
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2596
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1576
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:636
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:448
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1636
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1328
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4016
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3264
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2032
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3396
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1644
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3180
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4840
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4500
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2360
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4328
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:2736
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:4676
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:3928
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1860
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:1424
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:372
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1412
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3816
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4116
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:4880
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:332
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3880
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4532
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4548
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:4184
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:3780
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:1320
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4780
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2012
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:2380
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:708
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4448
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:2544
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3268
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2340
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2460
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:4744
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:676
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:3488
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3388
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:2176
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:2756
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • Executes dropped EXE
        PID:1868
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3392
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:928
      • C:\Windows\SysWOW64\system.exe
        C:\Windows\system32\system.exe
        3⤵
          PID:1432
        • C:\Windows\SysWOW64\system.exe
          C:\Windows\system32\system.exe
          3⤵
            PID:3804
          • C:\Windows\SysWOW64\system.exe
            C:\Windows\system32\system.exe
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4304
          • C:\Windows\SysWOW64\system.exe
            C:\Windows\system32\system.exe
            3⤵
            • System Location Discovery: System Language Discovery
            PID:3192
          • C:\Windows\SysWOW64\system.exe
            C:\Windows\system32\system.exe
            3⤵
              PID:3736
            • C:\Windows\SysWOW64\system.exe
              C:\Windows\system32\system.exe
              3⤵
              • System Location Discovery: System Language Discovery
              PID:712
            • C:\Windows\SysWOW64\system.exe
              C:\Windows\system32\system.exe
              3⤵
                PID:4336
              • C:\Windows\SysWOW64\system.exe
                C:\Windows\system32\system.exe
                3⤵
                  PID:3928
                • C:\Windows\SysWOW64\system.exe
                  C:\Windows\system32\system.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:1428
                • C:\Windows\SysWOW64\system.exe
                  C:\Windows\system32\system.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:1928
                • C:\Windows\SysWOW64\system.exe
                  C:\Windows\system32\system.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:392
                • C:\Windows\SysWOW64\system.exe
                  C:\Windows\system32\system.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:3452
                • C:\Windows\SysWOW64\system.exe
                  C:\Windows\system32\system.exe
                  3⤵
                    PID:3012
                  • C:\Windows\SysWOW64\system.exe
                    C:\Windows\system32\system.exe
                    3⤵
                      PID:4100
                    • C:\Windows\SysWOW64\system.exe
                      C:\Windows\system32\system.exe
                      3⤵
                        PID:216
                      • C:\Windows\SysWOW64\system.exe
                        C:\Windows\system32\system.exe
                        3⤵
                          PID:3844
                        • C:\Windows\SysWOW64\system.exe
                          C:\Windows\system32\system.exe
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:4880
                        • C:\Windows\SysWOW64\system.exe
                          C:\Windows\system32\system.exe
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:2388
                        • C:\Windows\SysWOW64\system.exe
                          C:\Windows\system32\system.exe
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:3880
                        • C:\Windows\SysWOW64\system.exe
                          C:\Windows\system32\system.exe
                          3⤵
                            PID:3152
                          • C:\Windows\SysWOW64\system.exe
                            C:\Windows\system32\system.exe
                            3⤵
                              PID:4700
                            • C:\Windows\SysWOW64\system.exe
                              C:\Windows\system32\system.exe
                              3⤵
                                PID:5088
                              • C:\Windows\SysWOW64\system.exe
                                C:\Windows\system32\system.exe
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:1416
                              • C:\Windows\SysWOW64\system.exe
                                C:\Windows\system32\system.exe
                                3⤵
                                  PID:1216
                                • C:\Windows\SysWOW64\system.exe
                                  C:\Windows\system32\system.exe
                                  3⤵
                                    PID:452
                                  • C:\Windows\SysWOW64\system.exe
                                    C:\Windows\system32\system.exe
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3912
                                  • C:\Windows\SysWOW64\system.exe
                                    C:\Windows\system32\system.exe
                                    3⤵
                                      PID:2804
                                    • C:\Windows\SysWOW64\system.exe
                                      C:\Windows\system32\system.exe
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:3716
                                    • C:\Windows\SysWOW64\system.exe
                                      C:\Windows\system32\system.exe
                                      3⤵
                                        PID:3800
                                      • C:\Windows\SysWOW64\system.exe
                                        C:\Windows\system32\system.exe
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:944
                                      • C:\Windows\SysWOW64\system.exe
                                        C:\Windows\system32\system.exe
                                        3⤵
                                          PID:4300
                                        • C:\Windows\SysWOW64\system.exe
                                          C:\Windows\system32\system.exe
                                          3⤵
                                            PID:1916
                                          • C:\Windows\SysWOW64\system.exe
                                            C:\Windows\system32\system.exe
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:2764
                                          • C:\Windows\SysWOW64\system.exe
                                            C:\Windows\system32\system.exe
                                            3⤵
                                              PID:3544
                                            • C:\Windows\SysWOW64\system.exe
                                              C:\Windows\system32\system.exe
                                              3⤵
                                                PID:4392
                                              • C:\Windows\SysWOW64\system.exe
                                                C:\Windows\system32\system.exe
                                                3⤵
                                                  PID:1780
                                                • C:\Windows\SysWOW64\system.exe
                                                  C:\Windows\system32\system.exe
                                                  3⤵
                                                    PID:1284
                                                  • C:\Windows\SysWOW64\system.exe
                                                    C:\Windows\system32\system.exe
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:460
                                                  • C:\Windows\SysWOW64\system.exe
                                                    C:\Windows\system32\system.exe
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2136
                                                  • C:\Windows\SysWOW64\system.exe
                                                    C:\Windows\system32\system.exe
                                                    3⤵
                                                      PID:1912
                                                    • C:\Windows\SysWOW64\system.exe
                                                      C:\Windows\system32\system.exe
                                                      3⤵
                                                        PID:2748
                                                      • C:\Windows\SysWOW64\system.exe
                                                        C:\Windows\system32\system.exe
                                                        3⤵
                                                          PID:1644
                                                        • C:\Windows\SysWOW64\system.exe
                                                          C:\Windows\system32\system.exe
                                                          3⤵
                                                            PID:1064
                                                          • C:\Windows\SysWOW64\system.exe
                                                            C:\Windows\system32\system.exe
                                                            3⤵
                                                              PID:3044
                                                            • C:\Windows\SysWOW64\system.exe
                                                              C:\Windows\system32\system.exe
                                                              3⤵
                                                                PID:1868
                                                              • C:\Windows\SysWOW64\system.exe
                                                                C:\Windows\system32\system.exe
                                                                3⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:928
                                                              • C:\Windows\SysWOW64\system.exe
                                                                C:\Windows\system32\system.exe
                                                                3⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2760
                                                              • C:\Windows\SysWOW64\system.exe
                                                                C:\Windows\system32\system.exe
                                                                3⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1340
                                                              • C:\Windows\SysWOW64\system.exe
                                                                C:\Windows\system32\system.exe
                                                                3⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1620
                                                              • C:\Windows\SysWOW64\system.exe
                                                                C:\Windows\system32\system.exe
                                                                3⤵
                                                                  PID:8
                                                                • C:\Windows\SysWOW64\system.exe
                                                                  C:\Windows\system32\system.exe
                                                                  3⤵
                                                                    PID:4508
                                                                  • C:\Windows\SysWOW64\system.exe
                                                                    C:\Windows\system32\system.exe
                                                                    3⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:712
                                                                  • C:\Windows\SysWOW64\system.exe
                                                                    C:\Windows\system32\system.exe
                                                                    3⤵
                                                                      PID:3696
                                                                    • C:\Windows\SysWOW64\system.exe
                                                                      C:\Windows\system32\system.exe
                                                                      3⤵
                                                                        PID:1680
                                                                      • C:\Windows\SysWOW64\system.exe
                                                                        C:\Windows\system32\system.exe
                                                                        3⤵
                                                                          PID:3636
                                                                        • C:\Windows\SysWOW64\system.exe
                                                                          C:\Windows\system32\system.exe
                                                                          3⤵
                                                                            PID:444
                                                                          • C:\Windows\SysWOW64\system.exe
                                                                            C:\Windows\system32\system.exe
                                                                            3⤵
                                                                              PID:2192
                                                                            • C:\Windows\SysWOW64\system.exe
                                                                              C:\Windows\system32\system.exe
                                                                              3⤵
                                                                                PID:3452
                                                                              • C:\Windows\SysWOW64\system.exe
                                                                                C:\Windows\system32\system.exe
                                                                                3⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1852
                                                                              • C:\Windows\SysWOW64\system.exe
                                                                                C:\Windows\system32\system.exe
                                                                                3⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1736
                                                                              • C:\Windows\SysWOW64\system.exe
                                                                                C:\Windows\system32\system.exe
                                                                                3⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2864
                                                                              • C:\Windows\SysWOW64\system.exe
                                                                                C:\Windows\system32\system.exe
                                                                                3⤵
                                                                                  PID:212
                                                                                • C:\Windows\SysWOW64\system.exe
                                                                                  C:\Windows\system32\system.exe
                                                                                  3⤵
                                                                                    PID:3932
                                                                                  • C:\Windows\SysWOW64\system.exe
                                                                                    C:\Windows\system32\system.exe
                                                                                    3⤵
                                                                                      PID:2524
                                                                                    • C:\Windows\SysWOW64\system.exe
                                                                                      C:\Windows\system32\system.exe
                                                                                      3⤵
                                                                                        PID:3372
                                                                                      • C:\Windows\SysWOW64\system.exe
                                                                                        C:\Windows\system32\system.exe
                                                                                        3⤵
                                                                                          PID:4972
                                                                                        • C:\Windows\SysWOW64\system.exe
                                                                                          C:\Windows\system32\system.exe
                                                                                          3⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:4532
                                                                                        • C:\Windows\SysWOW64\system.exe
                                                                                          C:\Windows\system32\system.exe
                                                                                          3⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:4292
                                                                                        • C:\Windows\SysWOW64\system.exe
                                                                                          C:\Windows\system32\system.exe
                                                                                          3⤵
                                                                                            PID:4548
                                                                                          • C:\Windows\SysWOW64\system.exe
                                                                                            C:\Windows\system32\system.exe
                                                                                            3⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:912
                                                                                          • C:\Windows\SysWOW64\system.exe
                                                                                            C:\Windows\system32\system.exe
                                                                                            3⤵
                                                                                              PID:4852
                                                                                            • C:\Windows\SysWOW64\system.exe
                                                                                              C:\Windows\system32\system.exe
                                                                                              3⤵
                                                                                                PID:2008
                                                                                              • C:\Windows\SysWOW64\system.exe
                                                                                                C:\Windows\system32\system.exe
                                                                                                3⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:3992
                                                                                              • C:\Windows\SysWOW64\system.exe
                                                                                                C:\Windows\system32\system.exe
                                                                                                3⤵
                                                                                                  PID:2988
                                                                                                • C:\Windows\SysWOW64\system.exe
                                                                                                  C:\Windows\system32\system.exe
                                                                                                  3⤵
                                                                                                    PID:4544
                                                                                                  • C:\Windows\SysWOW64\system.exe
                                                                                                    C:\Windows\system32\system.exe
                                                                                                    3⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:1296

                                                                                              Network

                                                                                              • flag-us
                                                                                                DNS
                                                                                                8.8.8.8.in-addr.arpa
                                                                                                Remote address:
                                                                                                8.8.8.8:53
                                                                                                Request
                                                                                                8.8.8.8.in-addr.arpa
                                                                                                IN PTR
                                                                                                Response
                                                                                                8.8.8.8.in-addr.arpa
                                                                                                IN PTR
                                                                                                dnsgoogle
                                                                                              • flag-us
                                                                                                DNS
                                                                                                232.168.11.51.in-addr.arpa
                                                                                                Remote address:
                                                                                                8.8.8.8:53
                                                                                                Request
                                                                                                232.168.11.51.in-addr.arpa
                                                                                                IN PTR
                                                                                                Response
                                                                                              • flag-us
                                                                                                DNS
                                                                                                172.210.232.199.in-addr.arpa
                                                                                                Remote address:
                                                                                                8.8.8.8:53
                                                                                                Request
                                                                                                172.210.232.199.in-addr.arpa
                                                                                                IN PTR
                                                                                                Response
                                                                                              • flag-us
                                                                                                DNS
                                                                                                95.221.229.192.in-addr.arpa
                                                                                                Remote address:
                                                                                                8.8.8.8:53
                                                                                                Request
                                                                                                95.221.229.192.in-addr.arpa
                                                                                                IN PTR
                                                                                                Response
                                                                                              • flag-us
                                                                                                DNS
                                                                                                22.160.190.20.in-addr.arpa
                                                                                                Remote address:
                                                                                                8.8.8.8:53
                                                                                                Request
                                                                                                22.160.190.20.in-addr.arpa
                                                                                                IN PTR
                                                                                                Response
                                                                                              • flag-us
                                                                                                DNS
                                                                                                196.249.167.52.in-addr.arpa
                                                                                                Remote address:
                                                                                                8.8.8.8:53
                                                                                                Request
                                                                                                196.249.167.52.in-addr.arpa
                                                                                                IN PTR
                                                                                                Response
                                                                                              • flag-us
                                                                                                DNS
                                                                                                86.23.85.13.in-addr.arpa
                                                                                                Remote address:
                                                                                                8.8.8.8:53
                                                                                                Request
                                                                                                86.23.85.13.in-addr.arpa
                                                                                                IN PTR
                                                                                                Response
                                                                                              • flag-us
                                                                                                DNS
                                                                                                171.39.242.20.in-addr.arpa
                                                                                                Remote address:
                                                                                                8.8.8.8:53
                                                                                                Request
                                                                                                171.39.242.20.in-addr.arpa
                                                                                                IN PTR
                                                                                                Response
                                                                                              • flag-us
                                                                                                DNS
                                                                                                36.56.20.217.in-addr.arpa
                                                                                                Remote address:
                                                                                                8.8.8.8:53
                                                                                                Request
                                                                                                36.56.20.217.in-addr.arpa
                                                                                                IN PTR
                                                                                                Response
                                                                                              • flag-us
                                                                                                DNS
                                                                                                240.143.123.92.in-addr.arpa
                                                                                                Remote address:
                                                                                                8.8.8.8:53
                                                                                                Request
                                                                                                240.143.123.92.in-addr.arpa
                                                                                                IN PTR
                                                                                                Response
                                                                                                240.143.123.92.in-addr.arpa
                                                                                                IN PTR
                                                                                                a92-123-143-240deploystaticakamaitechnologiescom
                                                                                              • flag-us
                                                                                                DNS
                                                                                                13.227.111.52.in-addr.arpa
                                                                                                Remote address:
                                                                                                8.8.8.8:53
                                                                                                Request
                                                                                                13.227.111.52.in-addr.arpa
                                                                                                IN PTR
                                                                                                Response
                                                                                              No results found
                                                                                              • 8.8.8.8:53
                                                                                                8.8.8.8.in-addr.arpa
                                                                                                dns
                                                                                                66 B
                                                                                                90 B
                                                                                                1
                                                                                                1

                                                                                                DNS Request

                                                                                                8.8.8.8.in-addr.arpa

                                                                                              • 8.8.8.8:53
                                                                                                232.168.11.51.in-addr.arpa
                                                                                                dns
                                                                                                72 B
                                                                                                158 B
                                                                                                1
                                                                                                1

                                                                                                DNS Request

                                                                                                232.168.11.51.in-addr.arpa

                                                                                              • 8.8.8.8:53
                                                                                                172.210.232.199.in-addr.arpa
                                                                                                dns
                                                                                                74 B
                                                                                                128 B
                                                                                                1
                                                                                                1

                                                                                                DNS Request

                                                                                                172.210.232.199.in-addr.arpa

                                                                                              • 8.8.8.8:53
                                                                                                95.221.229.192.in-addr.arpa
                                                                                                dns
                                                                                                73 B
                                                                                                144 B
                                                                                                1
                                                                                                1

                                                                                                DNS Request

                                                                                                95.221.229.192.in-addr.arpa

                                                                                              • 8.8.8.8:53
                                                                                                22.160.190.20.in-addr.arpa
                                                                                                dns
                                                                                                72 B
                                                                                                158 B
                                                                                                1
                                                                                                1

                                                                                                DNS Request

                                                                                                22.160.190.20.in-addr.arpa

                                                                                              • 8.8.8.8:53
                                                                                                196.249.167.52.in-addr.arpa
                                                                                                dns
                                                                                                73 B
                                                                                                147 B
                                                                                                1
                                                                                                1

                                                                                                DNS Request

                                                                                                196.249.167.52.in-addr.arpa

                                                                                              • 8.8.8.8:53
                                                                                                86.23.85.13.in-addr.arpa
                                                                                                dns
                                                                                                70 B
                                                                                                144 B
                                                                                                1
                                                                                                1

                                                                                                DNS Request

                                                                                                86.23.85.13.in-addr.arpa

                                                                                              • 8.8.8.8:53
                                                                                                171.39.242.20.in-addr.arpa
                                                                                                dns
                                                                                                72 B
                                                                                                158 B
                                                                                                1
                                                                                                1

                                                                                                DNS Request

                                                                                                171.39.242.20.in-addr.arpa

                                                                                              • 8.8.8.8:53
                                                                                                36.56.20.217.in-addr.arpa
                                                                                                dns
                                                                                                71 B
                                                                                                131 B
                                                                                                1
                                                                                                1

                                                                                                DNS Request

                                                                                                36.56.20.217.in-addr.arpa

                                                                                              • 8.8.8.8:53
                                                                                                240.143.123.92.in-addr.arpa
                                                                                                dns
                                                                                                73 B
                                                                                                139 B
                                                                                                1
                                                                                                1

                                                                                                DNS Request

                                                                                                240.143.123.92.in-addr.arpa

                                                                                              • 8.8.8.8:53
                                                                                                13.227.111.52.in-addr.arpa
                                                                                                dns
                                                                                                72 B
                                                                                                158 B
                                                                                                1
                                                                                                1

                                                                                                DNS Request

                                                                                                13.227.111.52.in-addr.arpa

                                                                                              MITRE ATT&CK Enterprise v15

                                                                                              Replay Monitor

                                                                                              Loading Replay Monitor...

                                                                                              Downloads

                                                                                              • C:\Windows\userinit.exe

                                                                                                Filesize

                                                                                                388KB

                                                                                                MD5

                                                                                                e9d241d83d6df24d69f9c72fad13cc9f

                                                                                                SHA1

                                                                                                2607b9d33f9c1425b2b0480c0f9c4e591f6ad5e7

                                                                                                SHA256

                                                                                                3313b765b69555465d780c6a446ad9254c8f69d978553ea960076223f7963a97

                                                                                                SHA512

                                                                                                ce234473ce0071e205c32d8b5cc97b6607a7cbe9d54bddb4b1a131ce63878145b3b3ae97f33bfab28c56307d8ad9f4ac772616e1ba5fe6a468578d148335ef10

                                                                                              • memory/216-396-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/332-223-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/372-197-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/392-381-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/448-109-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/452-435-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/452-84-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/636-104-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/676-307-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/708-273-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/712-361-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/852-39-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/928-338-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/944-454-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1048-214-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1140-59-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1216-431-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1320-253-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1328-119-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1412-202-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1416-427-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1424-192-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1428-24-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1428-373-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1432-342-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1576-99-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1636-114-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1644-144-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1736-49-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1780-477-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1792-34-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1852-44-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1856-69-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1860-187-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1868-330-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1916-462-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/1928-377-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/2012-263-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/2032-134-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/2176-322-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/2340-293-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/2360-164-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/2380-268-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/2388-407-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/2544-283-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/2596-94-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/2736-173-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/2756-326-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/2764-466-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/2804-443-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3152-415-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3180-149-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3192-354-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3264-129-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3268-288-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3388-317-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3392-334-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3396-139-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3452-385-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3488-312-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3544-470-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3696-0-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3696-14-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3716-447-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3780-248-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3792-64-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3804-346-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3808-79-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3816-207-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3880-411-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3880-228-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3912-439-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3912-89-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3928-369-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/3964-74-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/4016-124-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/4100-392-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/4116-212-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/4184-243-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/4300-458-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/4304-350-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/4336-365-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/4448-278-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/4500-159-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/4528-29-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/4532-233-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/4548-238-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/4676-178-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/4700-419-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/4744-302-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/4780-258-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/4812-54-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/4840-154-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/4880-403-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/4880-218-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              • memory/5088-423-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                Filesize

                                                                                                388KB

                                                                                              We care about your privacy.

                                                                                              This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.