Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    67s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/12/2024, 04:20

General

  • Target

    dcfab1844d8110d6fc87c84df363df28_JaffaCakes118.exe

  • Size

    292KB

  • MD5

    dcfab1844d8110d6fc87c84df363df28

  • SHA1

    7ead7f81aaf53861013ee18b721bfb65c7c72243

  • SHA256

    244fd237fd1df6b7a85b5b0a0c91f6ea5f550b0b059053d13a8f71ff550fcf1b

  • SHA512

    e61cff6d7da4ecba732bcb6c919be4a7cbaa2f36edbdde90b0bbaabee630e39590188183a90b5bc6b8965db96649e8bfc484159a3f5453ebfb8c697734c83aeb

  • SSDEEP

    6144:tMi9J0aPyRa2B9UX4Wt8f32Qhzeu2Vz1y8MYYHWBT7mD:BqMft8f32QhzeLzhMY97m

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 7 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
  • Pony family
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables taskbar notifications via registry modification
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 20 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\dcfab1844d8110d6fc87c84df363df28_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dcfab1844d8110d6fc87c84df363df28_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4408
    • C:\Users\Admin\AppData\Local\Temp\dcfab1844d8110d6fc87c84df363df28_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\dcfab1844d8110d6fc87c84df363df28_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\73D88\AEBE9.exe%C:\Users\Admin\AppData\Roaming\73D88
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3472
    • C:\Users\Admin\AppData\Local\Temp\dcfab1844d8110d6fc87c84df363df28_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\dcfab1844d8110d6fc87c84df363df28_JaffaCakes118.exe startC:\Program Files (x86)\88121\lvvm.exe%C:\Program Files (x86)\88121
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5000
    • C:\Program Files (x86)\LP\E937\E05.tmp
      "C:\Program Files (x86)\LP\E937\E05.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2024
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4836
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1096
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2828
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4936
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4476
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2680
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:1292
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4824
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4984
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:3064
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3976
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:396
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2324
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4416
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:648
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2636
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4116
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1052
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4820
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4536
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1544
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3096
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4372
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:920
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:4184
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3820
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2072
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Modifies registry class
    PID:3248
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:3084
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:3796
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:4164
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:4572
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:2092
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:3328
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:1732
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:2908
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:4152
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:2944
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:4164
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:2176
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:3904
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:1160
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:1448
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:5020
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:4864
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:4972
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:3612
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:3548
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:3200
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:4280
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:4584
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4936
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:4060
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:5012
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:4316
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:1768
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:992
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:8
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:3688
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:1732
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:3832
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:4564
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:212
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:2724
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:2028
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:3584
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:540
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:4904
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:3772
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:2360
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:2492
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:2324
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:2152
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                                PID:368
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:3552
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                  1⤵
                                                                                                    PID:2688
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:2712
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:4332

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\Program Files (x86)\LP\E937\E05.tmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                        MD5

                                                                                                        b8ae4687d11bf9c1cb3b5950d665d8d6

                                                                                                        SHA1

                                                                                                        20d438cf648a53e9db25483d5d9350a9ac91f43e

                                                                                                        SHA256

                                                                                                        5cec021da894b89fb5d6203683c8596b4d28e3bf1efbd8e1f5793cbe445c32b6

                                                                                                        SHA512

                                                                                                        ea47e2dc5aff41443a02424cb0c60bf51320665d82b79ca31876e5f4368878786979fb3e2f7f940145312c38565fc62bcfc223d4536e0555835bfc3e4895146f

                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                        Filesize

                                                                                                        471B

                                                                                                        MD5

                                                                                                        f9f4f28330762f1e5dfc6bac948e28d2

                                                                                                        SHA1

                                                                                                        9f359b2af69ac60fb892d5ee9bba3145191095df

                                                                                                        SHA256

                                                                                                        c6ccd3baf57741a9c7468bbd9a0c5b9ad6be2f447803306e647763bf76079476

                                                                                                        SHA512

                                                                                                        c7a90b4a44dc4089a691574bcd718b9df9d984a7ce6da918c48649162310f6b7a04da5e172da3c4560059b9ba01bb71ff5a0ff0364ddbee360b3644a27e6a76b

                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                        Filesize

                                                                                                        412B

                                                                                                        MD5

                                                                                                        3ad6bd9aeb607ee4b1f0b0d9d5e54910

                                                                                                        SHA1

                                                                                                        1a0ab895f70ce8a055b318a9b434ad01a5962e01

                                                                                                        SHA256

                                                                                                        3897ee86f01909b6ac508599da7477ac074fd4a5238b52bacbf87a741c5a8a9a

                                                                                                        SHA512

                                                                                                        fcd652794cf8a295af3ab066aeeede26a1c7b9d86b034ba5a3b4494b56f0f892fad56dad1af8582420f00aab19516992344949e373d3f736523987ac019379b6

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        9d7e573542ffb552cefa50eca028a463

                                                                                                        SHA1

                                                                                                        22425eb4eb8ed44566f715ef9b64b327e4fb2802

                                                                                                        SHA256

                                                                                                        565fb2b7ae1064d75bb6a2416250c45d556b63c95ebe2b16bcbf97da23c4d548

                                                                                                        SHA512

                                                                                                        51fdfea2fa0ec45c80b8090f6dc7b89678b512ef87b4e1f978b9b5c13b38522bcaa697a0b41b63ed5a7507058a2da01c620f51c9af7189409d08d8e8b36f10d1

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15

                                                                                                        Filesize

                                                                                                        36KB

                                                                                                        MD5

                                                                                                        0e2a09c8b94747fa78ec836b5711c0c0

                                                                                                        SHA1

                                                                                                        92495421ad887f27f53784c470884802797025ad

                                                                                                        SHA256

                                                                                                        0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                                                        SHA512

                                                                                                        61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer

                                                                                                        Filesize

                                                                                                        36KB

                                                                                                        MD5

                                                                                                        ab0262f72142aab53d5402e6d0cb5d24

                                                                                                        SHA1

                                                                                                        eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                                                        SHA256

                                                                                                        20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                                                        SHA512

                                                                                                        bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\YOZOSN6K\microsoft.windows[1].xml

                                                                                                        Filesize

                                                                                                        97B

                                                                                                        MD5

                                                                                                        e6ba99d8293b4c7951bad0a2c6761b8e

                                                                                                        SHA1

                                                                                                        87aaf2d975cdef4db219e4f9f2b1469dd05a6b0b

                                                                                                        SHA256

                                                                                                        773b2b8b752a5bfd3d93b7475dbb7f659bad014ffd06292ee0450c216892ac29

                                                                                                        SHA512

                                                                                                        e6861e87688861f4c43d80f9e98996fc476a11d4e147eb3c55f66d6f1abc065690e2662dd34dca32c0284b64056b95142d932697aa1fa6d6b755ef0f57031ee0

                                                                                                      • C:\Users\Admin\AppData\Roaming\73D88\8121.3D8

                                                                                                        Filesize

                                                                                                        996B

                                                                                                        MD5

                                                                                                        b5fcb619230a751da22ca86d152b952f

                                                                                                        SHA1

                                                                                                        06c49214a2a6b576d89f1ef261c042e8602dd55b

                                                                                                        SHA256

                                                                                                        3f6ae836a2eeaee6db477f4e13aace75a21c4da2dd197fdcafe61adff6d60972

                                                                                                        SHA512

                                                                                                        a4f4ac6168444af3d550050dda74a7f7b0cf2bed1adaadae20c1565422f65eb70a4005960dacd4da906f290442abfa4f7f02abc3c9ba92effb193dfc75bf7091

                                                                                                      • C:\Users\Admin\AppData\Roaming\73D88\8121.3D8

                                                                                                        Filesize

                                                                                                        600B

                                                                                                        MD5

                                                                                                        5d8e87525a045db81d46863887b315fb

                                                                                                        SHA1

                                                                                                        9fa9a888a3d52fbefc6ae23e0dc2d2b1361b1a26

                                                                                                        SHA256

                                                                                                        8690a65f0052e072eff7ead16192fa9e4cbb055c2891caec104c264f6d80fad7

                                                                                                        SHA512

                                                                                                        6e730a1b3003ffc7781d6da4607c115a1013db722a6fe83bba744d223ba6652814e68cd0b65c3106480bf71b7e3577d5d445a1e99dec5c9f9095a4805490036c

                                                                                                      • C:\Users\Admin\AppData\Roaming\73D88\8121.3D8

                                                                                                        Filesize

                                                                                                        1KB

                                                                                                        MD5

                                                                                                        c9c9f7bfcd336f404b7cbeef309cbd03

                                                                                                        SHA1

                                                                                                        d3f8f796772c066964e0494f3b611a1600c123e4

                                                                                                        SHA256

                                                                                                        1f64ccd1ca607fa1d0b71bb0befd4aed356f5bcc03ee65d02e67eb63ca913c83

                                                                                                        SHA512

                                                                                                        9f7802ef9181c5b718e8ca3ab709e595cb9a04778b9d0952e6b97d9f6e3392ba3c496add17e90b0cf62da97f8f4d59c2658e93116dfc7e3d01d66b0bcf731c32

                                                                                                      • C:\Users\Admin\AppData\Roaming\73D88\8121.3D8

                                                                                                        Filesize

                                                                                                        1KB

                                                                                                        MD5

                                                                                                        2e38de3025cd1627f67aa15475064688

                                                                                                        SHA1

                                                                                                        57a34391713ca66e6847f5122fa23a6b46a2846a

                                                                                                        SHA256

                                                                                                        19639dfd196e9cd903ae9a5c0d996bda3cd02fbbdc2bf4b21bb91d838fec8c32

                                                                                                        SHA512

                                                                                                        7f57f4389e75ff7426e26534eca7021aa49d2654eab427984eee96377780347eb4aad75af75ebf8e3f65d02adf91e19c6110e204a55cdc8ad724f24e3abd92d2

                                                                                                      • memory/396-596-0x0000022D07E50000-0x0000022D07E70000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/396-627-0x0000022D08420000-0x0000022D08440000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/396-607-0x0000022D07E10000-0x0000022D07E30000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/396-591-0x0000022D07000000-0x0000022D07100000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/396-590-0x0000022D07000000-0x0000022D07100000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/648-745-0x000001D402500000-0x000001D402600000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/648-760-0x000001D403490000-0x000001D4034B0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/648-750-0x000001D4034D0000-0x000001D4034F0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/648-772-0x000001D4038A0000-0x000001D4038C0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/648-746-0x000001D402500000-0x000001D402600000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/648-747-0x000001D402500000-0x000001D402600000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/920-1211-0x000001F2963E0000-0x000001F296400000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/920-1187-0x000001F294F00000-0x000001F295000000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/920-1200-0x000001F295DD0000-0x000001F295DF0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/920-1193-0x000001F295E10000-0x000001F295E30000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1052-908-0x0000025D832A0000-0x0000025D832C0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1052-897-0x0000025D832E0000-0x0000025D83300000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1052-928-0x0000025D838C0000-0x0000025D838E0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1292-443-0x0000000004930000-0x0000000004931000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/1544-1044-0x0000018C214A0000-0x0000018C214C0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1544-1075-0x0000018C21A80000-0x0000018C21AA0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1544-1056-0x0000018C21460000-0x0000018C21480000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2024-709-0x0000000000400000-0x000000000041D000-memory.dmp

                                                                                                        Filesize

                                                                                                        116KB

                                                                                                      • memory/2072-1342-0x0000023AB7460000-0x0000023AB7480000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2072-1337-0x0000023AB6300000-0x0000023AB6400000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/2072-1364-0x0000023AB7A40000-0x0000023AB7A60000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2072-1352-0x0000023AB7420000-0x0000023AB7440000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2324-744-0x0000000004020000-0x0000000004021000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2636-889-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2680-288-0x000001778A120000-0x000001778A140000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2680-303-0x0000017789DE0000-0x0000017789E00000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2680-283-0x0000017789100000-0x0000017789200000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/2680-318-0x000001778A4F0000-0x000001778A510000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3064-589-0x0000000004280000-0x0000000004281000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3096-1185-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3248-1493-0x0000000004570000-0x0000000004571000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3472-15-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                        Filesize

                                                                                                        432KB

                                                                                                      • memory/3472-17-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                        Filesize

                                                                                                        432KB

                                                                                                      • memory/3472-13-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                        Filesize

                                                                                                        432KB

                                                                                                      • memory/3796-1501-0x000001DE7BAC0000-0x000001DE7BAE0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3796-1489-0x000001DE7AC00000-0x000001DE7AD00000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/3796-1526-0x000001DE7C0E0000-0x000001DE7C100000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3796-1494-0x000001DE7BB00000-0x000001DE7BB20000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4184-1335-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/4408-11-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                        Filesize

                                                                                                        432KB

                                                                                                      • memory/4408-121-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                        Filesize

                                                                                                        432KB

                                                                                                      • memory/4408-1-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                        Filesize

                                                                                                        420KB

                                                                                                      • memory/4408-1628-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                        Filesize

                                                                                                        432KB

                                                                                                      • memory/4408-14-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                        Filesize

                                                                                                        420KB

                                                                                                      • memory/4408-2-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                        Filesize

                                                                                                        432KB

                                                                                                      • memory/4408-710-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                        Filesize

                                                                                                        432KB

                                                                                                      • memory/4820-1038-0x0000000004F60000-0x0000000004F61000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/4936-282-0x0000000003EC0000-0x0000000003EC1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/4984-450-0x000001EF280B0000-0x000001EF280D0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4984-462-0x000001EF28070000-0x000001EF28090000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4984-481-0x000001EF28480000-0x000001EF284A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/5000-123-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                        Filesize

                                                                                                        432KB