Analysis

  • max time kernel
    43s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2024 23:59

General

  • Target

    916c129a8fb2db8eaa0c59fa6e2fb09c_JaffaCakes118.exe

  • Size

    869KB

  • MD5

    916c129a8fb2db8eaa0c59fa6e2fb09c

  • SHA1

    da6474359c6df22ccb2204a7789abac9e333fb64

  • SHA256

    b6596a3044cd0adf0597d6a693761a4d3f6a173ca7b2bdd474de02a7541ad8a9

  • SHA512

    08ae1dac96c1eaf1d7e789f05f17877b6098b8a62519459264ced684cb3ec10ba83e56d51495f0f32bb06c5afbccd829045d932cace08f13803074c3fe25270e

  • SSDEEP

    12288:uTxoIoMSC5feDyNcrCJc5jmwUIC+xvlFRiawBjnSgKLTK7Jmh9Ukz+OxIcHDLEUg:uTxxSoLcrCJcU0V5Kj7+OJmhPzgRlK

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 32 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 31 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\916c129a8fb2db8eaa0c59fa6e2fb09c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\916c129a8fb2db8eaa0c59fa6e2fb09c_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3948
    • C:\ProgramData\defender.exe
      C:\ProgramData\defender.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3980
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:4776
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:3496
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3968
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:2108
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3240
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2980
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3648
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3500
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4080
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2372
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4560
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Modifies registry class
      PID:3896
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:2976
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:2960
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:1908
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:3608
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:4416
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:4104
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    PID:4264
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:3160
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    PID:1456
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:3528
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    PID:116
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:3428
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:2920
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:656
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:5092
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:3908
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:4488
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:1408
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:1216
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:4564
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:2184
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    PID:4168
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:3640
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    PID:1692
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:4156
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:1616
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:1684
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
      PID:3924
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:4224
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:4100
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:3596
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:1548
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:3124
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:1972
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:3756
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:1356
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:4636
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:5104
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:2036
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:4160
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:4128
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4036
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:3316
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:3932
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:1068
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:1392
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:432
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:1176
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:3588
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:452
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4740
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:2168
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:3752
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3880
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:3708
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:920
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:3228
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:628
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:1168
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:3748
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:872
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:3456
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:3776
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:2892
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:2192
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:4336
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:436
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:4980
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:1048
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:3360
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:4272
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:1760
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:4688
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:3600
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:2188
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:3848
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:3740
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:1156
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:3700
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:2788
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:4252
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:1460
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:4752
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:4388
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                        PID:4828
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        explorer.exe
                                                                                                                        1⤵
                                                                                                                          PID:788
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe
                                                                                                                          1⤵
                                                                                                                            PID:3960
                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                            explorer.exe
                                                                                                                            1⤵
                                                                                                                              PID:2956
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              explorer.exe
                                                                                                                              1⤵
                                                                                                                                PID:2820
                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                explorer.exe
                                                                                                                                1⤵
                                                                                                                                  PID:1924
                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                  explorer.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:796
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:2792
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      explorer.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:3400
                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                        explorer.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:1932
                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                          explorer.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:2528
                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                            explorer.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:2408
                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                              explorer.exe
                                                                                                                                              1⤵
                                                                                                                                                PID:4072
                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                explorer.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:4056
                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                  explorer.exe
                                                                                                                                                  1⤵
                                                                                                                                                    PID:3348
                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                    explorer.exe
                                                                                                                                                    1⤵
                                                                                                                                                      PID:3760
                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                      explorer.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:4028
                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                        explorer.exe
                                                                                                                                                        1⤵
                                                                                                                                                          PID:2012
                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                          explorer.exe
                                                                                                                                                          1⤵
                                                                                                                                                            PID:1268
                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                            explorer.exe
                                                                                                                                                            1⤵
                                                                                                                                                              PID:1656
                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                              explorer.exe
                                                                                                                                                              1⤵
                                                                                                                                                                PID:748
                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                explorer.exe
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:2516
                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                  explorer.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:1336
                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                    explorer.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:2692
                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                      explorer.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:3344
                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                        explorer.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:2340
                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                          explorer.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:3656
                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                            explorer.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:1076
                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                              explorer.exe
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:1520
                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                explorer.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:4148
                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:3168
                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:3460
                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:800
                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:2980
                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:2576
                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:4908
                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:740
                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:3780
                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:516
                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:2776
                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:4588
                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:4836
                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:4088
                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:3252
                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:3172
                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:2688
                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:1364
                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:2472
                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:976
                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:4748
                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:3020
                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:1056
                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:2620
                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:3544
                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:5000
                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:704
                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:4604
                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:4172
                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:112
                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:4692
                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:3032
                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:4724
                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:1744
                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:4960
                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:1976
                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:4616
                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:4212
                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:3404
                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:4120
                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:3940
                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:1612
                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:4608
                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:1740
                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:404
                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:3504
                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:3416
                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:2268
                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:1784
                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:4572
                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:2440
                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:4932
                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:4780
                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:2496
                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:4952
                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:3432
                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:4024
                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:3836
                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:4304
                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:2584
                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:4468

                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                        • C:\ProgramData\defender.exe

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          819KB

                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                          3719cbb8edfc521c44344d2cc924b4e8

                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                          759c21aee7a3e5d6057c81bd7a8ae46c180db3c1

                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                          8923eb179e005215e101a1873ed8fb05e17f141dac206105ffe499a31fd18594

                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                          ca02a13911933a31f5e566191dfb47872e8608d8df38574554ea5fcb51913e6bdd2fed7d77d8f0900543a24822e075ad936b191c1dfc38f8316897b17cac78db

                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          471B

                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                          afe0c80c0429fc1bfd088ca9181f6b09

                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                          5c931e2e1a826cf7f83e46ba961af4163fa98456

                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                          8bcd790c76716fbdfbc532d6415d55a41bd242b27d7115a43a74c42d9fcccd5a

                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                          71c2452ecddb13b9ccd953f0570bd128aa8e874361199e7850f8a9e0f2c010b6873b713812a339ab866c8e53e9310772740bd197b3b2630636985f3001399f0e

                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          412B

                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                          716778953c658cad9b9dc8ee9aa25afe

                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                          b3086ee911408b23d1f99866f1dcd73ab7fe7898

                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                          98260acb3391d58d6997a371220c75bdc6ab8fa8815e14097a32005cfa41f0ce

                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                          381072e7f1f045a8501f17616f3920dea066ef436c6bf8232724ab1c42a7d5d22571b92b04b87ac23ebb3f97d79c21c2b35dd56816c2cd55b8db2422f0f20dab

                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\IconCache.db

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          15KB

                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                          988f2c9c65f05810f2737ce0e48a2999

                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                          9eb75a848ebcc8ee040e6c09a149188ecaef22d4

                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                          1b7ab8c7153e418856782017b812355652d9b503174443fc41384f762fe2df2b

                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                          2d4ea51835c2fa2889ee197f92e4e8fa15bd9aa9ada7e3980cdba8efbc2797b17109b8acbcb792527d76aa85beaf0d0661b21580d9a7da526f24c4634fbdebbd

                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          1022B

                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                          d9c7a1fd974011e8c0327914a8f6153a

                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                          c72014f401a4463adb9bce0a9878675696798bd9

                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                          9619e9266324dc41fd37b139321ab594c459d175050c805eaaccddbec0a38f7d

                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                          b5b484305f41f0faa7cd5d8d4ac8a5008f2ecd972603438824778f72a41202e824a61b33a1f960392a5150bcb29d772c58d17810992ed249a9a18862811acbb1

                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Desktop\Malware Protection.lnk

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          679B

                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                          c195d6c4ca75d887de2b8d0a2c520729

                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                          335c8da0e59d34943753324acf4a9eee8a2f8d8d

                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                          5daa28e27d8023963128cb78ff6febc0c2ff67e6c71148f307cd1ffe3f0d5e99

                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                          1f40658dc2189250aad2f0d7d78f28529a885042ae7971d854899f03b1f77b708c6a11282de316897eb3530cab1d0eaedcfff2abf56ed08e436445a4c0e9ded4

                                                                                                                                                                                                                                                                                                        • memory/2372-51-0x00000000047D0000-0x00000000047D1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/3948-8-0x0000000000404000-0x0000000000405000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/3948-3-0x0000000000400000-0x000000000069C000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          2.6MB

                                                                                                                                                                                                                                                                                                        • memory/3948-2-0x0000000002690000-0x00000000026A0000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                                        • memory/3948-0-0x0000000000400000-0x000000000069C000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          2.6MB

                                                                                                                                                                                                                                                                                                        • memory/3948-1-0x0000000002690000-0x00000000026A0000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                                        • memory/3948-23-0x0000000000400000-0x000000000069C000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          2.6MB

                                                                                                                                                                                                                                                                                                        • memory/3948-25-0x0000000002690000-0x00000000026A0000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                                        • memory/3948-24-0x0000000002690000-0x00000000026A0000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                                        • memory/3968-34-0x0000000003F90000-0x0000000003F91000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/3980-20-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-59-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-22-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-35-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-21-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-37-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-19-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-18-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-43-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-44-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-16-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-15-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-58-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-28-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-60-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-61-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-62-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-63-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-64-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-65-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-66-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-67-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-68-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-69-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                                                                                        • memory/3980-70-0x0000000000400000-0x0000000000A22000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.1MB