Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    68s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 14:32

General

  • Target

    0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe

  • Size

    285KB

  • MD5

    0f29e077fa0884f247d0a8052b2c5c93

  • SHA1

    cf91a1e86e9efe92e0127c1db549b385b8bb0704

  • SHA256

    75b9246878a960227a4eed745a2c356d11687572d0dd2b89d5afd60faf6b39a1

  • SHA512

    9d5ca93aae220c4ecb75b988dee5bc8f75c92fc6fc969718dd38f453f08353b5c144d8f011b5b40155b4f52460dc066d4aec382845ec2198ed64c27678a5d32e

  • SSDEEP

    6144:O9j178jCWXkANmZGceQhAmrf+jTCWdCJqv8+nY:a6jCekoD5QmIaTCWYJqv8+nY

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables taskbar notifications via registry modification
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 20 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3460
    • C:\Users\Admin\AppData\Local\Temp\0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\C8403\A4D69.exe%C:\Users\Admin\AppData\Roaming\C8403
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4296
    • C:\Users\Admin\AppData\Local\Temp\0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\0f29e077fa0884f247d0a8052b2c5c93_JaffaCakes118.exe startC:\Program Files (x86)\03D9C\lvvm.exe%C:\Program Files (x86)\03D9C
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2920
    • C:\Program Files (x86)\LP\69FC\219C.tmp
      "C:\Program Files (x86)\LP\69FC\219C.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1020
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1220
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1604
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2624
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1232
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2012
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5060
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    PID:4196
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2428
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3644
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:2572
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3956
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2260
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3056
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3268
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1604
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2192
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4092
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2260
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:736
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3268
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:764
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4000
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1304
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4884
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3492
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3756
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1776
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2520
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4820
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
      PID:436
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:1696
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:4572
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:864
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:1660
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:3888
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:4000
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:748
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:4580
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:3620
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:2144
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4048
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:868
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:3716
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:1408
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:1588
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:3380
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:3348
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:4792
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:1576
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:2268
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:2084
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:3232
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:4220
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:1084
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:3100
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:3612
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:1764
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:3560
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:4176
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:1364
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:116
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:3796
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:1196
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:2272
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:3644
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:2880
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:3584
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:4008
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:1652
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:2896
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:3868
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:1864
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:2232
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:4648
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:944
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:1368
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:5036
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:4320
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:4076

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\Program Files (x86)\LP\69FC\219C.tmp

                                                                                                        Filesize

                                                                                                        100KB

                                                                                                        MD5

                                                                                                        50777c38a35804872660aa71c7eb52d2

                                                                                                        SHA1

                                                                                                        c94bdd4378d0e9f0bb2a71edca520bd49251a7aa

                                                                                                        SHA256

                                                                                                        44761b2153a01f2cd930d6b87fc3e2ba09e8940e4d096b556e99c74f26938faa

                                                                                                        SHA512

                                                                                                        0beaa0e126af6adab4867e40fbfe554b829a769bd22af5aad1cfe5f63d569c16c2a003d7b98724efdf8fe255b6c8b124487c999db70c2012ba68faa130fa9ce4

                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                                        Filesize

                                                                                                        471B

                                                                                                        MD5

                                                                                                        6a406ad96e5b0fb95b19fd5c525659e8

                                                                                                        SHA1

                                                                                                        89c48a17daeb402c78a406ed31980ce381c1e66a

                                                                                                        SHA256

                                                                                                        fff6d4beb65672c459a492cf64ebdcc3ae0b5e635533fd761876300e1f4da6a5

                                                                                                        SHA512

                                                                                                        c336db63c06d794ea67bd2d779db15777d1caf244119e76bd640e58e0168afc52dd744be20dfa4bdeb45dfb9435e3cc187099c1ac745d8a7e19ed9a343d886de

                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                                        Filesize

                                                                                                        420B

                                                                                                        MD5

                                                                                                        d36c31874a5736191dbd05a1b207c01c

                                                                                                        SHA1

                                                                                                        73c134c7da7ad5b43c92dd01c64a02a0644de257

                                                                                                        SHA256

                                                                                                        64951c40ad6badc1e47868049a78e99c9d78e2de1bd99c3d830bb3d188ab0242

                                                                                                        SHA512

                                                                                                        2426468a0044870f0d29c2078cef525e06fba7dacd0e262fc9251f4625e47d30a11e59971a0d77bfd18c9558d20590154caf828cd354db217fa3d640673ee5d7

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        e16e58c8108dab608e2ab99b226ae9da

                                                                                                        SHA1

                                                                                                        d802f615db80604214895b57ad30571a6f430116

                                                                                                        SHA256

                                                                                                        05ed99bebf2ae84908740a09afea69016e23a5acc95c8e579a1fd8125a8b3cbc

                                                                                                        SHA512

                                                                                                        d3bff01b82e006fb1af605c0b2467e108594b0b911225944e906a3f991c8be57af909683bc2751cb4127fe34dce82f8fd2942618fe9b5241d0e084f6a05e0f73

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PNRCYTYY\microsoft.windows[1].xml

                                                                                                        Filesize

                                                                                                        97B

                                                                                                        MD5

                                                                                                        5e22ac0cbcc2cfca04d1b6983de47d88

                                                                                                        SHA1

                                                                                                        2cec1efb9cc1a5882ea7880bfcbe947c3361c37f

                                                                                                        SHA256

                                                                                                        15c78df0dc6078f22a8655187b6bc79f1142f5ca86fc151e361b748b119bdc4d

                                                                                                        SHA512

                                                                                                        fe181661eb50f5460f51015d576f688ffd9aa9a9c8e2dd1308416a15e2784d5fd1c0dfb3e2819c357c999aa9be208b372b185616e17c3691cf798e4e861bf870

                                                                                                      • C:\Users\Admin\AppData\Roaming\C8403\3D9C.840

                                                                                                        Filesize

                                                                                                        996B

                                                                                                        MD5

                                                                                                        10845970081999c41a672231882777e1

                                                                                                        SHA1

                                                                                                        4a6ef08b4b058dc914e13d702d2ec9d3f7f66381

                                                                                                        SHA256

                                                                                                        bcc5dc8d82dca2ef0d5b4f8825a2915e23b72fc504be9dfdfec2cfa32e17e3a0

                                                                                                        SHA512

                                                                                                        946bbcf8ea7379ec8991a3dfa7a49f77a8f1cb858296044b33a0033e55f0494e8dbbf53b4bd992f2af64e30058e6dc8b93d1b7fe03e9599ef5fa2938f8ef0d34

                                                                                                      • C:\Users\Admin\AppData\Roaming\C8403\3D9C.840

                                                                                                        Filesize

                                                                                                        600B

                                                                                                        MD5

                                                                                                        6a4d245348d17f7d3aca80e7bd8db6d8

                                                                                                        SHA1

                                                                                                        8b815871fef99e7abd81b067ab58db0517a56a4a

                                                                                                        SHA256

                                                                                                        0b1e283799c244bfc20d10966559a4a6f5a677fc7ccd006c9f3c51da879caf22

                                                                                                        SHA512

                                                                                                        a316f69a58c44e222b329a88b4dcbafda8565d9bdcb71ca9912ab73cd8387089be3614e9b4e0327950a7e9a4fc2780fbfa6840289f266fa6c724a68d20bf3143

                                                                                                      • C:\Users\Admin\AppData\Roaming\C8403\3D9C.840

                                                                                                        Filesize

                                                                                                        1KB

                                                                                                        MD5

                                                                                                        4f6dac1faa89617ca35c2d40f3a24f35

                                                                                                        SHA1

                                                                                                        92224cc939d05a1aaa57f4b86b5ff5358d7bdd04

                                                                                                        SHA256

                                                                                                        b049150751c0f80608b74bf4b3271287324dbfbca9be411f16c2b13c201aa46f

                                                                                                        SHA512

                                                                                                        dd87e1664e9c912b629e9c8a38af8cb837162bea9d26e3a22aa06e3d09db5b6a241f466544a7c4d3b341c0e23de1cb17c6bcdc36d17acfdfff54d18c278b6b7d

                                                                                                      • C:\Users\Admin\AppData\Roaming\C8403\3D9C.840

                                                                                                        Filesize

                                                                                                        1KB

                                                                                                        MD5

                                                                                                        3b985c99315572556283d51234fc43cb

                                                                                                        SHA1

                                                                                                        90bf5ed7f691f4a9ccc1c4fab0fc3c25b502b307

                                                                                                        SHA256

                                                                                                        c1eb5353d1ca783ba0c0493c2ff97337ecc3e3a5137a869f71af9eefe2e27ea9

                                                                                                        SHA512

                                                                                                        61441601f7353992c82a58e84c7f5028dd07260d6a0809ae378bf30832226474100efe1bf449c1f3797de136abf49376010bf44863d65d6690f6c2a0f29f4b91

                                                                                                      • memory/436-1498-0x0000021E5F400000-0x0000021E5F500000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/436-1501-0x0000021E60560000-0x0000021E60580000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/436-1520-0x0000021E60520000-0x0000021E60540000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/436-1533-0x0000021E60930000-0x0000021E60950000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/436-1497-0x0000021E5F400000-0x0000021E5F500000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/736-1047-0x00000000040C0000-0x00000000040C1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/764-1080-0x0000014FBE8A0000-0x0000014FBE8C0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/764-1067-0x0000014FBE280000-0x0000014FBE2A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/764-1054-0x0000014FBE2C0000-0x0000014FBE2E0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/764-1050-0x0000014FBD360000-0x0000014FBD460000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/764-1049-0x0000014FBD360000-0x0000014FBD460000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/864-1671-0x000001AC0E6B0000-0x000001AC0E6D0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/864-1643-0x000001AC0D180000-0x000001AC0D280000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/864-1648-0x000001AC0DFE0000-0x000001AC0E000000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/864-1659-0x000001AC0DFA0000-0x000001AC0DFC0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/864-1644-0x000001AC0D180000-0x000001AC0D280000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/1020-712-0x0000000000400000-0x000000000041D000-memory.dmp

                                                                                                        Filesize

                                                                                                        116KB

                                                                                                      • memory/1232-284-0x0000000002380000-0x0000000002381000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/1604-765-0x0000022CBAF60000-0x0000022CBAF80000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1604-777-0x0000022CBB370000-0x0000022CBB390000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1604-754-0x0000022CBAFA0000-0x0000022CBAFC0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1696-1641-0x0000000004C40000-0x0000000004C41000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/1776-1361-0x000002D30E7D0000-0x000002D30E7F0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1776-1350-0x000002D30EA20000-0x000002D30EA40000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1776-1372-0x000002D30EDE0000-0x000002D30EE00000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2192-898-0x00000000040C0000-0x00000000040C1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2260-601-0x000001CEDD470000-0x000001CEDD490000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2260-906-0x0000019CA49B0000-0x0000019CA49D0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2260-928-0x0000019CA4D80000-0x0000019CA4DA0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2260-917-0x0000019CA4970000-0x0000019CA4990000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2260-624-0x000001CEDD840000-0x000001CEDD860000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2260-613-0x000001CEDD430000-0x000001CEDD450000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2520-1494-0x00000000044B0000-0x00000000044B1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2572-594-0x0000000004B70000-0x0000000004B71000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2920-118-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                        Filesize

                                                                                                        424KB

                                                                                                      • memory/3056-746-0x0000000004040000-0x0000000004041000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3460-116-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                        Filesize

                                                                                                        424KB

                                                                                                      • memory/3460-13-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                                        Filesize

                                                                                                        416KB

                                                                                                      • memory/3460-1-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                                        Filesize

                                                                                                        416KB

                                                                                                      • memory/3460-2-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                        Filesize

                                                                                                        424KB

                                                                                                      • memory/3460-1634-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                        Filesize

                                                                                                        424KB

                                                                                                      • memory/3460-739-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                        Filesize

                                                                                                        424KB

                                                                                                      • memory/3460-11-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                        Filesize

                                                                                                        424KB

                                                                                                      • memory/3492-1342-0x00000000044B0000-0x00000000044B1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3644-436-0x000002DFD5D00000-0x000002DFD5E00000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/3644-454-0x000002DFD6DE0000-0x000002DFD6E00000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3644-468-0x000002DFD73F0000-0x000002DFD7410000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3644-441-0x000002DFD7020000-0x000002DFD7040000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4000-1199-0x0000000003F00000-0x0000000003F01000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/4196-434-0x0000000004490000-0x0000000004491000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/4296-15-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                        Filesize

                                                                                                        424KB

                                                                                                      • memory/4296-14-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                        Filesize

                                                                                                        424KB

                                                                                                      • memory/4296-16-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                        Filesize

                                                                                                        424KB

                                                                                                      • memory/4884-1237-0x0000028BF2730000-0x0000028BF2750000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4884-1238-0x0000028BF2B40000-0x0000028BF2B60000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4884-1207-0x0000028BF2770000-0x0000028BF2790000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4884-1201-0x0000028BF1620000-0x0000028BF1720000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/5060-322-0x0000020DE0250000-0x0000020DE0270000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/5060-305-0x0000020DDFE40000-0x0000020DDFE60000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/5060-291-0x0000020DDFE80000-0x0000020DDFEA0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB