Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    65s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/01/2025, 05:25

General

  • Target

    JaffaCakes118_4e0adf26bb77e9f3c8e1cc9261d19080.exe

  • Size

    295KB

  • MD5

    4e0adf26bb77e9f3c8e1cc9261d19080

  • SHA1

    131bf8ff496bcc50a5b740078327ad3ae74c7510

  • SHA256

    123ae50352cfa0b7be3796444608c139b39c0d080a6aa875be185b10bc671727

  • SHA512

    a0476c27affb5850e11d8718f45a5b487999f343924d9aa3afb92bd0cbda5ae72f09c0cc55b30094063052f3376984e699688a8e6ffde155e7bf265345fc83d0

  • SSDEEP

    6144:x5MiHi5AZJBEt1ff8BzqxTMHBUs6sFU1EvfxekzsPB0F2RcUrqvhCn3g09OE:x5MiC+Z/Et1fz5iBxFU1E3xkuF2Rm4nw

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 7 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
  • Pony family
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables taskbar notifications via registry modification
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 20 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 14 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4e0adf26bb77e9f3c8e1cc9261d19080.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4e0adf26bb77e9f3c8e1cc9261d19080.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4928
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4e0adf26bb77e9f3c8e1cc9261d19080.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4e0adf26bb77e9f3c8e1cc9261d19080.exe startC:\Users\Admin\AppData\Roaming\DFEA5\97B0B.exe%C:\Users\Admin\AppData\Roaming\DFEA5
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2456
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4e0adf26bb77e9f3c8e1cc9261d19080.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4e0adf26bb77e9f3c8e1cc9261d19080.exe startC:\Program Files (x86)\A56D2\lvvm.exe%C:\Program Files (x86)\A56D2
      2⤵
      • System Location Discovery: System Language Discovery
      PID:664
    • C:\Program Files (x86)\LP\0B0D\5F13.tmp
      "C:\Program Files (x86)\LP\0B0D\5F13.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4268
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4808
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:5064
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3788
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3804
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2628
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4368
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4464
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4876
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:2728
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1532
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2304
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4976
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1684
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4864
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4496
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3828
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4384
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3324
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4732
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4908
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2260
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4140
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5036
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4232
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5060
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3848
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3844
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:4076
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:1464
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:3020
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:3584
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3404
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:2704
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:3968
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:4192
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:5044
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:1532
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:4348
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:5036
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:4068
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:1212
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4056
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:1332
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:3532
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:2688
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:4080
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:1456
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:2744
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:4336
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:4104
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4324
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:3208
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:3836
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3432
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:4144
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:5104
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:4376
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:4652
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:2868
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:1396
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:3968
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:2500
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:4260
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:4092
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:3532
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:3584
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:492
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:4056
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:460
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:4176
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:4372
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:60
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:4652
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:4348
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:1852
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:2352
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:2956

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\Program Files (x86)\LP\0B0D\5F13.tmp

                                                                                                        Filesize

                                                                                                        104KB

                                                                                                        MD5

                                                                                                        7e97af368e784db14cf2e463fb2fdca8

                                                                                                        SHA1

                                                                                                        013ae46a12471ab9a9732aca525136eb77cb8b16

                                                                                                        SHA256

                                                                                                        5b7c2062b9b3c8701b9471ae8c37657db0cf07da3131d9c7dccde21fbc0f98b2

                                                                                                        SHA512

                                                                                                        2cc3ae35a2794a842301024893038a5aec3a03f86acb66cfb7e5a22278600db61af3996e90596579d832337491fdfb2d9ae687438bf02b81c621bac579170d4f

                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                        Filesize

                                                                                                        471B

                                                                                                        MD5

                                                                                                        e71669bd6a9e74a156ac933b670362c4

                                                                                                        SHA1

                                                                                                        e9de4d9084739759348ab9da8f7d415f437571a2

                                                                                                        SHA256

                                                                                                        1688ce51440d686498eb53bdd725952c998ad20ed53b646434a835224381708a

                                                                                                        SHA512

                                                                                                        003dc287c29c988a7d75aca7e822d6067992da25391687e6caf08c259e0bd3025055dd0713e810c425775435ba92a5dd6dc44e4cd13c51e975432ca010356673

                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                        Filesize

                                                                                                        412B

                                                                                                        MD5

                                                                                                        be918451944956e10a83ebbf14b2e5a6

                                                                                                        SHA1

                                                                                                        768eede49a5855c29049f0c986fd8531ae273805

                                                                                                        SHA256

                                                                                                        db434e360607b4b54c983061c9314bf8df9862c1c92e4bdc4170b7ed624b0845

                                                                                                        SHA512

                                                                                                        efefc953825c68bead945a090c65b408e05b8cb18d70125ba51be6cbf8adab7c1b2b29bf44e7ebae30c18988d94c589b511dcc34fc47e4a1dc8b874d4049c3ff

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        3992245985f427b386a531dc3a37ca95

                                                                                                        SHA1

                                                                                                        aedc977bdea2905bb8d7c587e4ab0fc6b4cb00fd

                                                                                                        SHA256

                                                                                                        df94f6b61840e370a7fe77e21235a96ef45a23693530eb0a30bca6460d201f68

                                                                                                        SHA512

                                                                                                        3f705e5fce0f9c883a3146dc47287db93d5ecb40a3675ebdd574374968893f8ada9f42c78cc31708d47e169460f75a95d9f933806be1416f20c6c9528b542da9

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15

                                                                                                        Filesize

                                                                                                        36KB

                                                                                                        MD5

                                                                                                        0e2a09c8b94747fa78ec836b5711c0c0

                                                                                                        SHA1

                                                                                                        92495421ad887f27f53784c470884802797025ad

                                                                                                        SHA256

                                                                                                        0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                                                        SHA512

                                                                                                        61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer

                                                                                                        Filesize

                                                                                                        36KB

                                                                                                        MD5

                                                                                                        ab0262f72142aab53d5402e6d0cb5d24

                                                                                                        SHA1

                                                                                                        eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                                                        SHA256

                                                                                                        20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                                                        SHA512

                                                                                                        bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\80GI1ZH7\microsoft.windows[1].xml

                                                                                                        Filesize

                                                                                                        97B

                                                                                                        MD5

                                                                                                        742f1cda58883699ef753f83244412ce

                                                                                                        SHA1

                                                                                                        38531f396e1d9dc9ba6bba0604149c377605f57a

                                                                                                        SHA256

                                                                                                        5ef67927e9fdebb14515728d51548c52536519b35b5a52728ca1d660d957025f

                                                                                                        SHA512

                                                                                                        11acf77cd15052ae9cf554ab666f6c1e629e174fad16659738a11bee6a53b857f375fe99701e7c14c14286193864449f5b88a208ff34f4874e8351dff6a3a6f2

                                                                                                      • C:\Users\Admin\AppData\Roaming\DFEA5\56D2.FEA

                                                                                                        Filesize

                                                                                                        996B

                                                                                                        MD5

                                                                                                        1ae089187984f1ed4573b69c07d165b7

                                                                                                        SHA1

                                                                                                        134da5575bafc738f1c0ce6ee12c8f0aaaf31e05

                                                                                                        SHA256

                                                                                                        851da1d3913aa531a1fb285b26131230eaccd4063fe016ddbdfe595046a5b0f6

                                                                                                        SHA512

                                                                                                        cab1d2f0881868ddba978c31915cddbd015045908d1c3385145a5bb2a462a25a32345a92406937ea14db52017299ee7707af55054d31a0b223cd60400111c2c1

                                                                                                      • C:\Users\Admin\AppData\Roaming\DFEA5\56D2.FEA

                                                                                                        Filesize

                                                                                                        600B

                                                                                                        MD5

                                                                                                        bf8f2aa4daed11e612a89950990ae10d

                                                                                                        SHA1

                                                                                                        31537113747904e21ec805a9b4143220606a6194

                                                                                                        SHA256

                                                                                                        a46e7d51c697181249b801ef2b56c4172922f7f948fad3819a83300b631aa8dc

                                                                                                        SHA512

                                                                                                        481b44b0bad3835ec2f9c6cd0f21001bc62ed4ff4cd7984b2bd9fcf910f5fbc414d8360fb1db5e55317ec88e394b9cb322bd6b8a60dfc782d7411964ce524195

                                                                                                      • C:\Users\Admin\AppData\Roaming\DFEA5\56D2.FEA

                                                                                                        Filesize

                                                                                                        1KB

                                                                                                        MD5

                                                                                                        e7f45550b542417bb7ed4194fb689bc1

                                                                                                        SHA1

                                                                                                        ef5510167f517ab50b6f2f3e57645444f6ed6e73

                                                                                                        SHA256

                                                                                                        f94b726c9882aa76fa66cea8705a4d40a97895a84b8d51434c80a26e2dd66fb0

                                                                                                        SHA512

                                                                                                        70f98e9c0366f462bcd454ff13bdcd95572f168c8446f09f19f9cbaa5ee75aff8dade8395a1ed59fd52967283c8d1abac39339f69a76594f99137d90cd15eb88

                                                                                                      • memory/664-134-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                        Filesize

                                                                                                        432KB

                                                                                                      • memory/1464-1393-0x000001B420970000-0x000001B420990000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1464-1370-0x000001B41F440000-0x000001B41F540000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/1464-1368-0x000001B41F440000-0x000001B41F540000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/1464-1373-0x000001B4205A0000-0x000001B4205C0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1464-1381-0x000001B420560000-0x000001B420580000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2260-1070-0x0000000004E40000-0x0000000004E41000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2304-481-0x000002A6D9200000-0x000002A6D9300000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/2304-482-0x000002A6D9200000-0x000002A6D9300000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/2304-486-0x000002A6DA300000-0x000002A6DA320000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2304-483-0x000002A6D9200000-0x000002A6D9300000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/2304-518-0x000002A6DA650000-0x000002A6DA670000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2304-513-0x000002A6D9FC0000-0x000002A6D9FE0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2456-16-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                        Filesize

                                                                                                        432KB

                                                                                                      • memory/2456-15-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                        Filesize

                                                                                                        432KB

                                                                                                      • memory/2456-13-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                        Filesize

                                                                                                        432KB

                                                                                                      • memory/2728-479-0x0000000004720000-0x0000000004721000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3020-1509-0x0000000002960000-0x0000000002961000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3324-921-0x00000000049A0000-0x00000000049A1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3844-1366-0x0000000003FF0000-0x0000000003FF1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3848-1219-0x000001BA6E100000-0x000001BA6E200000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/3848-1218-0x000001BA6E100000-0x000001BA6E200000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/3848-1223-0x000001BA6F1F0000-0x000001BA6F210000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3848-1231-0x000001BA6F1B0000-0x000001BA6F1D0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3848-1255-0x000001BA6F5C0000-0x000001BA6F5E0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4232-1217-0x0000000004820000-0x0000000004821000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/4268-623-0x0000000000400000-0x000000000041D000-memory.dmp

                                                                                                        Filesize

                                                                                                        116KB

                                                                                                      • memory/4368-319-0x0000000002D30000-0x0000000002D31000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/4384-775-0x0000019832600000-0x0000019832620000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4384-770-0x0000019831500000-0x0000019831600000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/4384-796-0x00000198329D0000-0x00000198329F0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4384-782-0x00000198325C0000-0x00000198325E0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4384-771-0x0000019831500000-0x0000019831600000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/4496-768-0x0000000002D60000-0x0000000002D61000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/4864-654-0x000001B02D640000-0x000001B02D660000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4864-642-0x000001B02D230000-0x000001B02D250000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4864-628-0x000001B02C200000-0x000001B02C300000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/4864-633-0x000001B02D270000-0x000001B02D290000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4864-630-0x000001B02C200000-0x000001B02C300000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/4864-629-0x000001B02C200000-0x000001B02C300000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/4876-355-0x000002218EEF0000-0x000002218EF10000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4876-325-0x000002218EB20000-0x000002218EB40000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4876-354-0x000002218E7E0000-0x000002218E800000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4908-928-0x000002229F520000-0x000002229F540000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4908-924-0x000002229E600000-0x000002229E700000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/4908-936-0x000002229F4E0000-0x000002229F500000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4908-946-0x000002229FB00000-0x000002229FB20000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4908-925-0x000002229E600000-0x000002229E700000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/4908-923-0x000002229E600000-0x000002229E700000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/4928-132-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                        Filesize

                                                                                                        432KB

                                                                                                      • memory/4928-625-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                        Filesize

                                                                                                        432KB

                                                                                                      • memory/4928-1-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                        Filesize

                                                                                                        420KB

                                                                                                      • memory/4928-1507-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                        Filesize

                                                                                                        432KB

                                                                                                      • memory/4928-14-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                        Filesize

                                                                                                        420KB

                                                                                                      • memory/4928-11-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                        Filesize

                                                                                                        432KB

                                                                                                      • memory/4928-2-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                        Filesize

                                                                                                        432KB

                                                                                                      • memory/4976-626-0x00000000046A0000-0x00000000046A1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/5036-1089-0x0000026AA8960000-0x0000026AA8980000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/5036-1099-0x0000026AA8D70000-0x0000026AA8D90000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/5036-1072-0x0000026AA7840000-0x0000026AA7940000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/5036-1077-0x0000026AA89A0000-0x0000026AA89C0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB