Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    83s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/09/2024, 03:31

General

  • Target

    fdb7408c370b3778fd7cffcb02116ba1_JaffaCakes118.exe

  • Size

    284KB

  • MD5

    fdb7408c370b3778fd7cffcb02116ba1

  • SHA1

    d597e2d622017f2091b7abb657b85498ae12f8ca

  • SHA256

    2a96a8f20bb83a4bdcb425fbd15b8217e941f030951d230e790bed786d42758e

  • SHA512

    c996a0ee7e6f60783c4e15d4e039514601cd5ad8ea2d3943b14caa2a42649b578bada3c1cbd0a964849383118107e3c3ed358b49300ea69173ccbbdaffebb0b2

  • SSDEEP

    6144:V0lJsa0dPA4NNXw0hlx1qepW2cV4/LoDgCJM9/fACv:+DzklN9zx1qGMV4/LT79Zv

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 13 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables taskbar notifications via registry modification
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 25 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\fdb7408c370b3778fd7cffcb02116ba1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fdb7408c370b3778fd7cffcb02116ba1_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1084
    • C:\Users\Admin\AppData\Local\Temp\fdb7408c370b3778fd7cffcb02116ba1_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\fdb7408c370b3778fd7cffcb02116ba1_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\82342\0D11A.exe%C:\Users\Admin\AppData\Roaming\82342
      2⤵
        PID:3804
      • C:\Users\Admin\AppData\Local\Temp\fdb7408c370b3778fd7cffcb02116ba1_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\fdb7408c370b3778fd7cffcb02116ba1_JaffaCakes118.exe startC:\Program Files (x86)\42118\lvvm.exe%C:\Program Files (x86)\42118
        2⤵
          PID:4176
        • C:\Program Files (x86)\LP\1AA8\396A.tmp
          "C:\Program Files (x86)\LP\1AA8\396A.tmp"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3792
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4504
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2824
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2736
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1880
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3568
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2664
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SendNotifyMessage
        PID:3884
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4728
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4692
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:5004
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2616
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4996
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        PID:1092
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1640
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3924
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:1240
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4740
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4008
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4144
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4512
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4064
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4408
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:5000
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3776
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4060
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1952
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3880
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:3224
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2548
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1160
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        PID:1940
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1640
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1096
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:5084
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1916
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3048
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:3612
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2736
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3756
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:2968
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:2972
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3424
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:2600
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:4792
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:1664
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3652
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:4304
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:4832
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:372
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:3168
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:4548
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:3160
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:628
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:3216
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:5084
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:2820
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:1876
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:4112
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:3756
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:2012
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4528
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:5084
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:4060
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:4960
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:3048
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:3040
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:5036
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:1776
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:1064
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:4156
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:4032
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:3880
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:1948
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:3484
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:3608
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:4156
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:2452
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:1472

                                                                                    Network

                                                                                    MITRE ATT&CK Enterprise v15

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    • C:\Program Files (x86)\LP\1AA8\396A.tmp

                                                                                      Filesize

                                                                                      101KB

                                                                                      MD5

                                                                                      1cec7ecd2bbbcc39e9dbcab83d7d67cf

                                                                                      SHA1

                                                                                      13a0cb757993e63c2b360c9ce1f17a3aac342ffe

                                                                                      SHA256

                                                                                      5d767de0b9378b94cf82683458078a385989098464566fbb92b48c4bab435d20

                                                                                      SHA512

                                                                                      6fd95f2fd2918ae66b420044fc1da82b1724d615c6d71cae2533a37e0851a99f20aaf7b360fa5059b6b67b414dbc7e023f1f5e86eab25f20ade834e501e6a39c

                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                      Filesize

                                                                                      471B

                                                                                      MD5

                                                                                      e97f8ff623c9dca38b905f119c583e55

                                                                                      SHA1

                                                                                      30d314121e48bef77c20571143e49b778d59e73d

                                                                                      SHA256

                                                                                      b8fece7706e939895e00d7df5a754fcdb714eef4cc07a86c5ae54980fa1527f8

                                                                                      SHA512

                                                                                      7d2beefe263c576fbc0f1eb0f3023604d9cda7c5f8244d3570aee507046eb8e5bd710ec066ac000e0b72a4cf4ae279102067b781cd5de5a1e7d623631bac6589

                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                      Filesize

                                                                                      420B

                                                                                      MD5

                                                                                      c8dba1f9051a69073806724a14354c9a

                                                                                      SHA1

                                                                                      f9a6856252f1f87892b7b5f325a9a91dc6162170

                                                                                      SHA256

                                                                                      8a6f0e39a5b8c7db6899aa9baeaec8d1915f9de0ecf3d96ebe3fdbd6b4c756a1

                                                                                      SHA512

                                                                                      eac82514aecce33b503792bb6ec2a649ad1ddf28b7f5f4bd09a8fdeb65020d906f6c3fc16f4d7a6f6940e709afea5f0b6b9781cb2b686444d55b25ff52919ef9

                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      b9db0abf2aa7f45c8789556b45e5429d

                                                                                      SHA1

                                                                                      a0c0c2634c0ff6fec887caab51189b671a21c1c1

                                                                                      SHA256

                                                                                      f8b257b44db660ec9b51ffbcf31106b15d805ecb87b8ab8e6951c52c0653c4cd

                                                                                      SHA512

                                                                                      8635bfd5d8b0aeca96dfaf4c2b571c5fb630dd8a2eadc6045a6e2aab51c5385f114e3ed8ee63d3d93d4bb733105fbc7d4c8e9512521597624455895cf2fe24e2

                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15

                                                                                      Filesize

                                                                                      36KB

                                                                                      MD5

                                                                                      0e2a09c8b94747fa78ec836b5711c0c0

                                                                                      SHA1

                                                                                      92495421ad887f27f53784c470884802797025ad

                                                                                      SHA256

                                                                                      0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                                      SHA512

                                                                                      61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer

                                                                                      Filesize

                                                                                      36KB

                                                                                      MD5

                                                                                      ab0262f72142aab53d5402e6d0cb5d24

                                                                                      SHA1

                                                                                      eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                                      SHA256

                                                                                      20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                                      SHA512

                                                                                      bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1EALJNKU\microsoft.windows[1].xml

                                                                                      Filesize

                                                                                      97B

                                                                                      MD5

                                                                                      e9474f76e56e4f8298ed32d85776ddc0

                                                                                      SHA1

                                                                                      85b5c1919bb4fe74dc30b4dd0911d1994dd0974f

                                                                                      SHA256

                                                                                      b62242af1adf03ea40e4dff979f8b28430afebd75f7bf0e04a54745a47972c61

                                                                                      SHA512

                                                                                      7b1b354c53b204e1ac9b9fba462dd2474cedf64607be42d5865ca2dca611b9b2224ed84ff696978d1ac35adccb2f2199111dffcf54cd4189dc5b989678b55ab6

                                                                                    • C:\Users\Admin\AppData\Roaming\82342\2118.234

                                                                                      Filesize

                                                                                      996B

                                                                                      MD5

                                                                                      01d275d608f0a891b73c82462ceb5027

                                                                                      SHA1

                                                                                      9be6f3767d3aeaeccf33c1780d4afca90f994ee1

                                                                                      SHA256

                                                                                      bc92d76afd99245dfdb4698880a2d71a89cb5701b3cbd05fd375845ea893d7f5

                                                                                      SHA512

                                                                                      8d5c7e6a81a5c8f422c9626ec481ab3d21419f63c7cd3dd14b5f6e5879caeb484b8489c10ed62c75cdf95f75030aa13259913addbfc26ce6e8098a1eec3e954a

                                                                                    • C:\Users\Admin\AppData\Roaming\82342\2118.234

                                                                                      Filesize

                                                                                      600B

                                                                                      MD5

                                                                                      2834491d395d6fefbd2e3d270c4d7444

                                                                                      SHA1

                                                                                      5ce1160a45ce27ae741bb0a01701547a5e8445a5

                                                                                      SHA256

                                                                                      bf798fe0445b30f3093ce414d6b54cc5b7f5b5c0e0054671c42870dcbe162b4a

                                                                                      SHA512

                                                                                      2592c3624588b816a499f56147bf89eed13adf70d33e21d1326233a43fb2f172460481c411b7e448764af0c6837f9eee38bda985ee2834e00519043ba8f30940

                                                                                    • C:\Users\Admin\AppData\Roaming\82342\2118.234

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      301086fc82c996872bc09732298e0807

                                                                                      SHA1

                                                                                      0df33edec380e555b058def647f05ff096a288c5

                                                                                      SHA256

                                                                                      b7c8f33ed7a3ecbdf875e9a7cbef8809ac735a986e452a27651ab6a756ff05de

                                                                                      SHA512

                                                                                      19451156059db0d524c8c63e3075c728c023ed198a72dfac8fee7564502370b7a43375e3fa939c73e97abcbe2dee757d6e3088b43418bf16b6cb2e8ccc16823f

                                                                                    • memory/1084-14-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                      Filesize

                                                                                      416KB

                                                                                    • memory/1084-132-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                      Filesize

                                                                                      428KB

                                                                                    • memory/1084-774-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                      Filesize

                                                                                      428KB

                                                                                    • memory/1084-1637-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                      Filesize

                                                                                      428KB

                                                                                    • memory/1084-1-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                      Filesize

                                                                                      416KB

                                                                                    • memory/1084-11-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                      Filesize

                                                                                      428KB

                                                                                    • memory/1084-2-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                      Filesize

                                                                                      428KB

                                                                                    • memory/1092-777-0x00000000048A0000-0x00000000048A1000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1096-1683-0x000001D80EF50000-0x000001D80EF70000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/1096-1652-0x000001D80EB80000-0x000001D80EBA0000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/1096-1662-0x000001D80EB40000-0x000001D80EB60000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/1160-1538-0x000002577F870000-0x000002577F890000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/1160-1515-0x000002577F4A0000-0x000002577F4C0000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/1160-1526-0x000002577F460000-0x000002577F480000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/1240-925-0x0000000004790000-0x0000000004791000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1880-312-0x00000000048A0000-0x00000000048A1000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/1940-1644-0x0000000004550000-0x0000000004551000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/2664-319-0x00000216FB920000-0x00000216FB940000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/2664-331-0x00000216FB8E0000-0x00000216FB900000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/2664-350-0x00000216FBCF0000-0x00000216FBD10000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/2664-314-0x00000216FA800000-0x00000216FA900000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                    • memory/2664-315-0x00000216FA800000-0x00000216FA900000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                    • memory/3048-1796-0x0000019DC3840000-0x0000019DC3860000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/3048-1792-0x0000019DC2500000-0x0000019DC2600000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                    • memory/3048-1793-0x0000019DC2500000-0x0000019DC2600000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                    • memory/3048-1791-0x0000019DC2500000-0x0000019DC2600000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                    • memory/3224-1507-0x0000000001020000-0x0000000001021000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/3776-1214-0x000002452BD00000-0x000002452BE00000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                    • memory/3776-1219-0x000002452CE40000-0x000002452CE60000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/3776-1251-0x000002452D210000-0x000002452D230000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/3776-1229-0x000002452CE00000-0x000002452CE20000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/3776-1215-0x000002452BD00000-0x000002452BE00000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                    • memory/3792-745-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                      Filesize

                                                                                      112KB

                                                                                    • memory/3804-13-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                      Filesize

                                                                                      428KB

                                                                                    • memory/3804-16-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                      Filesize

                                                                                      428KB

                                                                                    • memory/3804-15-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                      Filesize

                                                                                      428KB

                                                                                    • memory/3880-1396-0x00000290A70E0000-0x00000290A7100000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/3880-1373-0x00000290A6D20000-0x00000290A6D40000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/3880-1384-0x00000290A69D0000-0x00000290A69F0000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/3884-469-0x00000000044A0000-0x00000000044A1000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/3924-793-0x00000252721A0000-0x00000252721C0000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/3924-779-0x0000025271100000-0x0000025271200000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                    • memory/3924-778-0x0000025271100000-0x0000025271200000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                    • memory/3924-783-0x00000252721E0000-0x0000025272200000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/3924-806-0x00000252725B0000-0x00000252725D0000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/4008-932-0x0000025E2DDB0000-0x0000025E2DDD0000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/4008-954-0x0000025E2E180000-0x0000025E2E1A0000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/4008-942-0x0000025E2DD70000-0x0000025E2DD90000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/4060-1366-0x00000000042D0000-0x00000000042D1000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4064-1072-0x000001918A0B0000-0x000001918A0D0000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/4064-1103-0x000001918A480000-0x000001918A4A0000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/4064-1079-0x000001918A070000-0x000001918A090000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/4144-1065-0x00000000046D0000-0x00000000046D1000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4176-134-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                      Filesize

                                                                                      428KB

                                                                                    • memory/4408-1212-0x0000000004A90000-0x0000000004A91000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/4692-488-0x00000214F6A00000-0x00000214F6A20000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/4692-501-0x00000214F6E10000-0x00000214F6E30000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/4692-475-0x00000214F6A40000-0x00000214F6A60000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/4996-632-0x0000026BD6DE0000-0x0000026BD6E00000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/4996-641-0x0000026BD6DA0000-0x0000026BD6DC0000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/4996-663-0x0000026BD71B0000-0x0000026BD71D0000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                    • memory/5004-624-0x0000000004A70000-0x0000000004A71000-memory.dmp

                                                                                      Filesize

                                                                                      4KB

                                                                                    • memory/5084-1789-0x0000000004660000-0x0000000004661000-memory.dmp

                                                                                      Filesize

                                                                                      4KB