Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    61s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 14:17

General

  • Target

    0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe

  • Size

    314KB

  • MD5

    0f1aa5f6fd74c362e0921ec29398a43e

  • SHA1

    627cff04e9b812394c3569ee4e9ff98e5f5025bc

  • SHA256

    b44ac5d876a27677c138df4c57500613590573e36ea89c7074d94869571ec9c6

  • SHA512

    b36e077cdb8b0e24ae4e62b3be075fc180756ada06062dac2567a5794c27e55a8b00daf524a3994512d2229dd0d8110cb5a0ad0151bb2b873e837091cc8b16eb

  • SSDEEP

    6144:sGUfAWA+GdPAbt51c+2INc0oQjrzhe4NEZ18SGDZR/nBJJHzg0Vrmx:AfA+GdPeL1BlcbQj39GZiSGDZR/LJ00V

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables taskbar notifications via registry modification
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 18 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2984
    • C:\Users\Admin\AppData\Local\Temp\0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\E0E2D\CF908.exe%C:\Users\Admin\AppData\Roaming\E0E2D
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4348
    • C:\Users\Admin\AppData\Local\Temp\0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\0f1aa5f6fd74c362e0921ec29398a43e_JaffaCakes118.exe startC:\Program Files (x86)\2DA3F\lvvm.exe%C:\Program Files (x86)\2DA3F
      2⤵
      • System Location Discovery: System Language Discovery
      PID:228
    • C:\Program Files (x86)\LP\08DE\2DE1.tmp
      "C:\Program Files (x86)\LP\08DE\2DE1.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4396
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2320
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3424
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3520
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1784
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1852
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:5052
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2740
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4128
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:3640
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3144
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2368
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2096
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3740
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3648
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:228
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1300
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3472
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4156
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1012
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2428
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1916
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4212
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1116
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3664
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1012
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:776
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
      PID:2268
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:3964
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:2492
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:3456
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:2152
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:1492
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:4872
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:1112
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:2332
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:1496
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:1300
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:3540
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:4296
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:4192
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:3472
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:460
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:1560
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:1296
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:3492
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:3812
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:4928
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:3412
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:5080
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:324
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:3340
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:776
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:1188
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:2740
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:4872
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:3652
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:4168
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:1700
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:2336
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:1852
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:3504
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:3512
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:3928
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:1188
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:3772
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:4088
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:2564
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:3896
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:4368
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:4832
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:3516
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:3512
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:4892
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:1400
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:4460
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:4264
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:3652
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                            PID:2492
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                            1⤵
                                                                                                              PID:3624

                                                                                                            Network

                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            • C:\Program Files (x86)\LP\08DE\2DE1.tmp

                                                                                                              Filesize

                                                                                                              106KB

                                                                                                              MD5

                                                                                                              935d252de43cc52d42d8c5fdc7676106

                                                                                                              SHA1

                                                                                                              966be71764ce145763aec024eb68448fb1981a99

                                                                                                              SHA256

                                                                                                              8aa995d7637c52067ca57bc7017c2279ab7b427d55634ef5effab4bf2d9e9807

                                                                                                              SHA512

                                                                                                              dfbf507852bb7771a6d56b35ece4e1391ab56f7d3501ffb1f452b5acbf1c6faf76b6607893c96ee0663c1dd25f85dbece3a32aee52225ec09b8ee3db6440886b

                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                                              Filesize

                                                                                                              471B

                                                                                                              MD5

                                                                                                              6a406ad96e5b0fb95b19fd5c525659e8

                                                                                                              SHA1

                                                                                                              89c48a17daeb402c78a406ed31980ce381c1e66a

                                                                                                              SHA256

                                                                                                              fff6d4beb65672c459a492cf64ebdcc3ae0b5e635533fd761876300e1f4da6a5

                                                                                                              SHA512

                                                                                                              c336db63c06d794ea67bd2d779db15777d1caf244119e76bd640e58e0168afc52dd744be20dfa4bdeb45dfb9435e3cc187099c1ac745d8a7e19ed9a343d886de

                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                                              Filesize

                                                                                                              420B

                                                                                                              MD5

                                                                                                              a038a52dad1c6802dd327e7466b4767f

                                                                                                              SHA1

                                                                                                              c7b9a4b605ed48934d7c68bdfa7c30b3be086cb1

                                                                                                              SHA256

                                                                                                              9359c4caa6ec5d915842e603a01ab54dc62b1fd15f602c3e10fe52088b79fd39

                                                                                                              SHA512

                                                                                                              dc0fb34038eecd59b02c284956d11cfb1848d9429452fe1707be1bc750524db268c38e14381a2213209308b9283dd446ffb1533f265a25d71186b75e80ec1fb8

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                              Filesize

                                                                                                              2KB

                                                                                                              MD5

                                                                                                              fa34bc6d0db04a97939767f937f3b731

                                                                                                              SHA1

                                                                                                              a7e3e04a678e698d13777e8aa6b75a044fe50fe0

                                                                                                              SHA256

                                                                                                              77bfb75178cbfbd464d6e4e890a8aedf995781c36831ffd7b9978d49c525f669

                                                                                                              SHA512

                                                                                                              af520cb9fa362d28a3e3b76189ab06af02ef4e99f32cfc8c3be642dd1380bb9d61d1ff05738596dae11cb3710a0d2bfee659a115783267ad46cd6b5f9b261250

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{2F519BF2-C697-59F8-8F6A-1E19509CE66B}

                                                                                                              Filesize

                                                                                                              36KB

                                                                                                              MD5

                                                                                                              8aaad0f4eb7d3c65f81c6e6b496ba889

                                                                                                              SHA1

                                                                                                              231237a501b9433c292991e4ec200b25c1589050

                                                                                                              SHA256

                                                                                                              813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1

                                                                                                              SHA512

                                                                                                              1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer

                                                                                                              Filesize

                                                                                                              36KB

                                                                                                              MD5

                                                                                                              ab0262f72142aab53d5402e6d0cb5d24

                                                                                                              SHA1

                                                                                                              eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                                                              SHA256

                                                                                                              20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                                                              SHA512

                                                                                                              bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\VJ9UXBET\microsoft.windows[1].xml

                                                                                                              Filesize

                                                                                                              97B

                                                                                                              MD5

                                                                                                              d28bf9e615b97abc4f63418e57cc40bc

                                                                                                              SHA1

                                                                                                              65885f634c0b15cabd1caf45861e7767f3110e44

                                                                                                              SHA256

                                                                                                              92e5c802db2c618a0c0aec072bec43479f082c95f35157b117749fee0ec295f7

                                                                                                              SHA512

                                                                                                              23e0b838c4a4a91b117fa0292e0350d691aa78eda49299819aa684efd6c6ec03b73a7d231996cf4d7e6cd10311a4755b5a434cae732c6376276290cb52f12eb0

                                                                                                            • C:\Users\Admin\AppData\Roaming\E0E2D\DA3F.0E2

                                                                                                              Filesize

                                                                                                              996B

                                                                                                              MD5

                                                                                                              29bb316fb5c72f29a5d2e6fbebd21dd3

                                                                                                              SHA1

                                                                                                              9ddd8578096272ac0fca1ced313368530a15f889

                                                                                                              SHA256

                                                                                                              b84f98ad5e7797dc793c3a0fa8dd5bc3b0cb588c2463e7c3b3ae5520549f48c0

                                                                                                              SHA512

                                                                                                              d2bbe530df2da8c816b77d118b433746d01e0c104e6bcfde4bdc603687d3f8f4384fdb99bb58d859af7faf2ef621adf2d9f3223642552503bdbb1267aca41e8f

                                                                                                            • C:\Users\Admin\AppData\Roaming\E0E2D\DA3F.0E2

                                                                                                              Filesize

                                                                                                              600B

                                                                                                              MD5

                                                                                                              fbe3b142bbc2bd2f1ab258dadbddfb19

                                                                                                              SHA1

                                                                                                              9b77ec1780a4f816e15f35b2f5eabc91795cfe77

                                                                                                              SHA256

                                                                                                              74e5e4a1163da34500553443c1d93b7179d3e28410e748206caf1cc0a1c481a1

                                                                                                              SHA512

                                                                                                              a729dda9b2efbe882bb6e5a5a27f92f9ea02f12db330391274f6929c729871d1e2949db36270528b465ffc6231dd7b2f74200812d640f1c06497060c9b9e9ff6

                                                                                                            • C:\Users\Admin\AppData\Roaming\E0E2D\DA3F.0E2

                                                                                                              Filesize

                                                                                                              1KB

                                                                                                              MD5

                                                                                                              3b92ba9a7dea9e0d72ab2651bc5277f0

                                                                                                              SHA1

                                                                                                              2243c6cb002242b0057b8597166a71d9461ccfeb

                                                                                                              SHA256

                                                                                                              0e75c52ca46fc6a558684340a1790e0c7271643122f87e9963745b7fc328f4f6

                                                                                                              SHA512

                                                                                                              1edf785f90ee92858e5ecf884aaa2fdad5922aa5ebd3c1203e8f9e292c481ca12447cdb4abd82330968e831e0c2fda7f2580fc61f242a0f126fd4f342e8075eb

                                                                                                            • memory/228-768-0x0000000004610000-0x0000000004611000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/228-150-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                              Filesize

                                                                                                              432KB

                                                                                                            • memory/776-1215-0x00000267582B0000-0x00000267582D0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/776-1228-0x0000026758270000-0x0000026758290000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/776-1239-0x0000026758880000-0x00000267588A0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/1116-1098-0x000001979B4E0000-0x000001979B500000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/1116-1079-0x000001979ADD0000-0x000001979ADF0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/1116-1067-0x000001979B120000-0x000001979B140000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/1492-1545-0x0000028240C70000-0x0000028240C90000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/1492-1514-0x0000028240820000-0x0000028240840000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/1492-1508-0x000002823F500000-0x000002823F600000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                            • memory/1492-1521-0x00000282403E0000-0x0000028240400000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/1916-1059-0x00000000046A0000-0x00000000046A1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/2096-621-0x0000000004650000-0x0000000004651000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/2268-1357-0x0000000004C60000-0x0000000004C61000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/2332-1657-0x000002037ED00000-0x000002037EE00000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                            • memory/2368-476-0x0000025388D00000-0x0000025388E00000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                            • memory/2368-492-0x0000025389D80000-0x0000025389DA0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/2368-503-0x000002538A190000-0x000002538A1B0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/2368-480-0x0000025389DC0000-0x0000025389DE0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/2428-918-0x0000021C3BB00000-0x0000021C3BC00000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                            • memory/2428-920-0x0000021C3BB00000-0x0000021C3BC00000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                            • memory/2428-923-0x000002243DBC0000-0x000002243DBE0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/2428-946-0x000002243DF90000-0x000002243DFB0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/2428-935-0x000002243DB80000-0x000002243DBA0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/2492-1396-0x0000016F38010000-0x0000016F38030000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/2492-1365-0x0000016F37C40000-0x0000016F37C60000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/2492-1373-0x0000016F37C00000-0x0000016F37C20000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/2984-0-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                              Filesize

                                                                                                              432KB

                                                                                                            • memory/2984-2-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                              Filesize

                                                                                                              420KB

                                                                                                            • memory/2984-148-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                              Filesize

                                                                                                              432KB

                                                                                                            • memory/2984-619-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                              Filesize

                                                                                                              432KB

                                                                                                            • memory/2984-3-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                              Filesize

                                                                                                              432KB

                                                                                                            • memory/2984-13-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                              Filesize

                                                                                                              432KB

                                                                                                            • memory/2984-1505-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                              Filesize

                                                                                                              432KB

                                                                                                            • memory/2984-15-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                              Filesize

                                                                                                              420KB

                                                                                                            • memory/3456-1507-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/3472-806-0x0000022EFED30000-0x0000022EFED50000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/3472-784-0x0000022EFE920000-0x0000022EFE940000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/3472-774-0x0000022EFE960000-0x0000022EFE980000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/3640-472-0x0000000003F50000-0x0000000003F51000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/3648-631-0x00000291DC0A0000-0x00000291DC0C0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/3648-623-0x00000291DB000000-0x00000291DB100000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                            • memory/3648-641-0x00000291DC4B0000-0x00000291DC4D0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/3648-624-0x00000291DB000000-0x00000291DB100000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                            • memory/3648-628-0x00000291DC0E0000-0x00000291DC100000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/3664-1208-0x0000000004E20000-0x0000000004E21000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/4128-347-0x000002394AFD0000-0x000002394AFF0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/4128-333-0x000002394ABC0000-0x000002394ABE0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/4128-316-0x0000023949900000-0x0000023949A00000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                            • memory/4128-321-0x000002394AC00000-0x000002394AC20000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                            • memory/4128-318-0x0000023949900000-0x0000023949A00000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                            • memory/4156-916-0x0000000004E30000-0x0000000004E31000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/4348-16-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                              Filesize

                                                                                                              432KB

                                                                                                            • memory/4348-17-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                              Filesize

                                                                                                              432KB

                                                                                                            • memory/4348-19-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                              Filesize

                                                                                                              432KB

                                                                                                            • memory/4396-618-0x0000000000400000-0x000000000041D000-memory.dmp

                                                                                                              Filesize

                                                                                                              116KB

                                                                                                            • memory/4872-1655-0x0000000004350000-0x0000000004351000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/5052-314-0x0000000002D30000-0x0000000002D31000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB