Overview

overview

8

Static

static

3

11fc4ed7f4...18.exe

windows7-x64

8

11fc4ed7f4...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    68s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2024, 05:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    11fc4ed7f48d160cb6b31bd024368a62_JaffaCakes118.exe

  • Size

    72KB

  • MD5

    11fc4ed7f48d160cb6b31bd024368a62

  • SHA1

    8b974d765f65fc8cc5d1d3e3d825c7c7eb71e177

  • SHA256

    cd4438b64175fd5321b7782f890e199c94d96f3626a60b2c37e5a45a1773886d

  • SHA512

    002dd7773fc37ec9026caeae929fc7feb3d715fa7a684e202ef2694d45da25872a1afb5d2bde7b61cf19177808b62f871056ca9aa03afe4771744822613ddade

  • SSDEEP

    768:rJHiEaq8TU2F99G218OrzlgTScp1U1vhBqgAUAas4hefyT2t6VtM:r9iqIFLn+TDPU1ZoTwey1Vt

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 15 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives 3 TTPs 30 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 25 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\11fc4ed7f48d160cb6b31bd024368a62_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\11fc4ed7f48d160cb6b31bd024368a62_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Windows\system32\del.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3832
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2644
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3532
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4932
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3560
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1052
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3944
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1152
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:2160
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3432
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4008
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4184
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2352
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3136
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3212
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3792
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4532
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3544
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5020
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:628
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3388
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2916
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2952
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1680
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3444
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:4672
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3456
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2672
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4992
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1616
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2596
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3948
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5056
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2352
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3512
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2300
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3164
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1232
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3900
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2108
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4532
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:628
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:3216
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:2356
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:4372
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:4160
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:2764
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:4252
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:1380
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3616
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3040
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:2916
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:2080
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:4840
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:5104
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:3164
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:2764
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:548
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:3508
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:968
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:3668
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:3768
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:264
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:1236
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4120
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:3760
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:212
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:2212
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:3892
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:2036
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:2268
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:3872
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:968
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:1152
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:916
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:1376
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:4184
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:4892
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:3388
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:4152
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:4412
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:3564
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:4376
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:4224
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:4864
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:4324
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:1920
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:4332
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:404
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:2352
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:4060

                                                                                                      Network

                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                              Filesize

                                                                                                              471B

                                                                                                              MD5

                                                                                                              6414d215581638d14c738529b24976a4

                                                                                                              SHA1

                                                                                                              80b67d5ae79a7aeb03b0308af8094d550c571cdc

                                                                                                              SHA256

                                                                                                              6d66a44486442fa1f34befd675c1a0010f7dabc5698e790dc204db34daf3c504

                                                                                                              SHA512

                                                                                                              ec0d73e23e006913f67b433d8c92f86e141666e0422801231bf34195517752a0db976c0ea74253b56381f3260354053ca64b63ed45dd1bdfdd3478aa76952733

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                              Filesize

                                                                                                              420B

                                                                                                              MD5

                                                                                                              709a8a2a6f9424df6b75906d7ddb6e19

                                                                                                              SHA1

                                                                                                              8e58908a8202cffed53a50e071c6ceef612e3e3c

                                                                                                              SHA256

                                                                                                              b00f165bff03466f2251eec0daff7328fefb1531725b98a8bffa2d3445d1cb72

                                                                                                              SHA512

                                                                                                              e11b27127493ce758bfb92455325ea4cafd8b04df38bb374ff4b8bb0ef340acdaa77695e5c548320a6eb58f50ec8fa54227b32c9bae96eab5f11f5b9757d6fb5

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                              Filesize

                                                                                                              2KB

                                                                                                              MD5

                                                                                                              7a961e2fbebb9ff624f457a8c17b0603

                                                                                                              SHA1

                                                                                                              9240b0d03368ba344706ca157d3e054c9646ef66

                                                                                                              SHA256

                                                                                                              3eb4813f1aeb5e37e0624f2103f2773a1de473ad1879a04cde17784dc03ab511

                                                                                                              SHA512

                                                                                                              af59664420411fc0fb747e62276d8661a1263cfbabd4505098f0650176c0a7c0636865277279cfc9f04cbfe9a04dc03a84be8873d4371b5112aba80bb77f5461

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
                                                                                                              Filesize

                                                                                                              36KB

                                                                                                              MD5

                                                                                                              0e2a09c8b94747fa78ec836b5711c0c0

                                                                                                              SHA1

                                                                                                              92495421ad887f27f53784c470884802797025ad

                                                                                                              SHA256

                                                                                                              0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                                                              SHA512

                                                                                                              61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
                                                                                                              Filesize

                                                                                                              36KB

                                                                                                              MD5

                                                                                                              ab0262f72142aab53d5402e6d0cb5d24

                                                                                                              SHA1

                                                                                                              eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                                                              SHA256

                                                                                                              20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                                                              SHA512

                                                                                                              bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\IHOCIHIW\microsoft.windows[1].xml
                                                                                                              Filesize

                                                                                                              96B

                                                                                                              MD5

                                                                                                              10447c28373b986c3dce4e7f2156814c

                                                                                                              SHA1

                                                                                                              03a482fa42dea8871c350394101b11f341ef6762

                                                                                                              SHA256

                                                                                                              376615a0b4dac87295162c3d924e67e4bf0dd77e02af1264c1520f22ec5378d8

                                                                                                              SHA512

                                                                                                              4fab536505b12b462254a2cfad102fabf29161a25f824de2b0201265c406f6a14b13049767bb2a6afff5ffe5e7703be0b7906a1740fea3d0dc2d6d8c13459abd

                                                                                                              Download Submit

                                                                                                            • C:\Windows\SysWOW64\del.bat
                                                                                                              Filesize

                                                                                                              248B

                                                                                                              MD5

                                                                                                              a10a86b9aa57cd2b8460bedf1720a6a5

                                                                                                              SHA1

                                                                                                              0af316fe2525b0d6963fa41ac04a3f04a79950b5

                                                                                                              SHA256

                                                                                                              9af8f854dc3baa724049541d7f60fb306e7c6900f413701b8fd57b5a70c554b4

                                                                                                              SHA512

                                                                                                              7c231fca80e528f05c1a69937e06c135b3a981363ed2163e71fd19ce33e702ec20d9214f39979125ad7f3ed60ef14aeb81af7ceb8ea3621ef01407020eef14e3

                                                                                                              Download Submit

                                                                                                            • memory/628-611-0x0000000004350000-0x0000000004351000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/1052-14-0x00000000034C0000-0x00000000034C1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/1152-21-0x0000020FB02B0000-0x0000020FB02D0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/1152-34-0x0000020FB0270000-0x0000020FB0290000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/1152-52-0x0000020FB0880000-0x0000020FB08A0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/2160-166-0x0000000003F90000-0x0000000003F91000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/2352-1219-0x000001DBB02A0000-0x000001DBB02C0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/2352-1238-0x000001DBB0670000-0x000001DBB0690000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/2352-1215-0x000001DBAF140000-0x000001DBAF240000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/2352-1214-0x000001DBAF140000-0x000001DBAF240000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/2352-1227-0x000001DBB0260000-0x000001DBB0280000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/2596-1071-0x0000023BD6AF0000-0x0000023BD6B10000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/2596-1067-0x0000023BD5C00000-0x0000023BD5D00000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/2596-1085-0x0000023BD6AB0000-0x0000023BD6AD0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/2596-1068-0x0000023BD5C00000-0x0000023BD5D00000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/2596-1097-0x0000023BD70C0000-0x0000023BD70E0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/2672-932-0x000001E5BB290000-0x000001E5BB2B0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/2672-944-0x000001E5BB8A0000-0x000001E5BB8C0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/2672-917-0x000001E5BA370000-0x000001E5BA470000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/2672-922-0x000001E5BB2D0000-0x000001E5BB2F0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/2672-918-0x000001E5BA370000-0x000001E5BA470000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/2916-618-0x00000178E0360000-0x00000178E0380000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/2916-613-0x00000178DF200000-0x00000178DF300000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/2916-640-0x00000178E0730000-0x00000178E0750000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/2916-628-0x00000178E0320000-0x00000178E0340000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/2916-614-0x00000178DF200000-0x00000178DF300000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/2952-763-0x0000000004480000-0x0000000004481000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/3136-348-0x0000022EDD130000-0x0000022EDD150000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3136-312-0x0000022EDBBC0000-0x0000022EDBCC0000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/3136-316-0x0000022EDCD20000-0x0000022EDCD40000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3136-311-0x0000022EDBBC0000-0x0000022EDBCC0000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/3136-324-0x0000022EDCCE0000-0x0000022EDCD00000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3164-1364-0x000001FBB7620000-0x000001FBB7640000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3164-1359-0x000001FBB6500000-0x000001FBB6600000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/3164-1361-0x000001FBB6500000-0x000001FBB6600000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/3212-458-0x0000000004A30000-0x0000000004A31000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/3444-802-0x000001A2DAF40000-0x000001A2DAF60000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3444-779-0x000001A2DAB30000-0x000001A2DAB50000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3444-770-0x000001A2DAB70000-0x000001A2DAB90000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/3444-766-0x000001A2D9A20000-0x000001A2D9B20000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/3444-767-0x000001A2D9A20000-0x000001A2D9B20000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/3512-1358-0x0000000004740000-0x0000000004741000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/3948-1212-0x0000000004610000-0x0000000004611000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/4008-197-0x0000025D46600000-0x0000025D46620000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4008-173-0x0000025D46240000-0x0000025D46260000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4008-169-0x0000025D45100000-0x0000025D45200000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/4008-168-0x0000025D45100000-0x0000025D45200000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/4008-185-0x0000025D46200000-0x0000025D46220000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4184-309-0x0000000004170000-0x0000000004171000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/4532-460-0x000002303D900000-0x000002303DA00000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/4532-465-0x000002303EA00000-0x000002303EA20000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4532-461-0x000002303D900000-0x000002303DA00000-memory.dmp

                                                                                                              Filesize

                                                                                                              1024KB

                                                                                                              Download

                                                                                                            • memory/4532-487-0x000002303EDD0000-0x000002303EDF0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4532-475-0x000002303E9C0000-0x000002303E9E0000-memory.dmp

                                                                                                              Filesize

                                                                                                              128KB

                                                                                                              Download

                                                                                                            • memory/4672-916-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/4992-1065-0x0000000004050000-0x0000000004051000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download