Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    69s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2025, 18:52

General

  • Target

    JaffaCakes118_d016e63391e47d45f244e7205ebc712b.exe

  • Size

    287KB

  • MD5

    d016e63391e47d45f244e7205ebc712b

  • SHA1

    05de4503b14933267a9498a52920290ab88a9898

  • SHA256

    23ae88ebe838fb372e2ab3c6be466606c510936d8b8910ef941bc7cf919623da

  • SHA512

    f88bbf558213a3adda2e0e1a7721384a2c65bfd7a3c227a0990fa44954b0f25e7c842db6dbcdd887009e6fc6396456d7aa0b4513c41e3f630edf62205c75644b

  • SSDEEP

    6144:Jlq904HDzA6skiQUVwerZIKFGSNUXT0cI/kX1PABS4brjXMMc:jizA6sxl9rZfGT0cOkX1os4bn

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 7 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
  • Pony family
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables taskbar notifications via registry modification
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 20 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d016e63391e47d45f244e7205ebc712b.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d016e63391e47d45f244e7205ebc712b.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3128
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d016e63391e47d45f244e7205ebc712b.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d016e63391e47d45f244e7205ebc712b.exe startC:\Users\Admin\AppData\Roaming\7915B\97B0B.exe%C:\Users\Admin\AppData\Roaming\7915B
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3056
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d016e63391e47d45f244e7205ebc712b.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d016e63391e47d45f244e7205ebc712b.exe startC:\Program Files (x86)\5B64E\lvvm.exe%C:\Program Files (x86)\5B64E
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4712
    • C:\Program Files (x86)\LP\0B07\B17.tmp
      "C:\Program Files (x86)\LP\0B07\B17.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2416
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3752
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4932
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1696
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4632
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3032
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4424
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:3652
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4324
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4224
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of SendNotifyMessage
    PID:2444
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2220
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:860
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:5088
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2708
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4772
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:4196
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3012
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2704
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:5116
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3084
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3516
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:1932
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1436
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3464
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2296
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2708
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4292
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4696
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:4012
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:1776
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:4940
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:3848
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3260
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:2772
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:3228
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:936
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:2952
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:2504
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:3848
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:1440
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:2464
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:1144
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:2112
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:3000
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:2656
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:1160
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:3428
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:4984
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:3296
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:4024
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:3088
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:2452
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:556
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:3852
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:4712
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:4352
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:860
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:5088
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:1496
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:3864
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:3036
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:2120
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:3352
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:392
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:3228
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:220
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:2112
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:3988
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:3620
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:4432
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                        1⤵
                                                                                          PID:4824
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:2284
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:4732
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                                PID:1512
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:3396
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:2884
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                    1⤵
                                                                                                      PID:3864

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • C:\Program Files (x86)\LP\0B07\B17.tmp

                                                                                                      Filesize

                                                                                                      102KB

                                                                                                      MD5

                                                                                                      57401a2069d022a5dc6ffee91de43906

                                                                                                      SHA1

                                                                                                      6e2850bde22f345739bf32031b2c2fb8850e0185

                                                                                                      SHA256

                                                                                                      9792c1645ecabeb90e2a61eb8a34ff0aa685eea55d61cbe47a667a3aca7e437b

                                                                                                      SHA512

                                                                                                      f4498f1ccf80bfd305f2b312e6e09b68271f1468cb3505120539bae7cf72a66609a5fcbd66ed5274fb466fa2c3dc13cf61f83ad3105303c333f19f696c3c96aa

                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                      Filesize

                                                                                                      471B

                                                                                                      MD5

                                                                                                      959d2a9c777132fe5498a165d5bbaaf7

                                                                                                      SHA1

                                                                                                      5cd8dd5a857fd362647a22ec0732207888f29bb9

                                                                                                      SHA256

                                                                                                      8bf88caa748bd496eb1290b073a40bc4d595a64ee5be59bd001826c5ec9befba

                                                                                                      SHA512

                                                                                                      66b2f65cb3ca7bf905aea846fc34ed6b818174438f4277114784162ed0b2e8bd18b54f195847ee765889750e8ddb903615367d71dbe0a12cc28cf1f07bcca923

                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                      Filesize

                                                                                                      412B

                                                                                                      MD5

                                                                                                      6df3c0cfe4c499632e36ff28482af206

                                                                                                      SHA1

                                                                                                      2cc932530110875ddfd9ccfdbcf2a9323b192471

                                                                                                      SHA256

                                                                                                      f9208c6d71b1fea263b296ee571c30e2580f4fcc2085062c4a53c11121a118c4

                                                                                                      SHA512

                                                                                                      38a648f4e129e244df65e2668926402acff49e64cd09efc21be0e88a7905758599c2739dee16fe513f2890dd14eb26898817accdd4e62648fe8241514ea63ec0

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      83ba46aa8fcb63b9dc5a041d197bffb8

                                                                                                      SHA1

                                                                                                      65e904d3b1f32ff0c8f1e0f6634391188c4741d7

                                                                                                      SHA256

                                                                                                      bd842c9a16da738065042854fab6f081ff213e0a535fe65722b9df95d3eab717

                                                                                                      SHA512

                                                                                                      e50acd4ed0f6a563a3bae7c1d625d2247b241627fb3ff5fec910b8ef9e9fce975adbd237d135b42a54f5f93465f083189f70b0f59990f9f6836df0f032298672

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel

                                                                                                      Filesize

                                                                                                      36KB

                                                                                                      MD5

                                                                                                      fb5f8866e1f4c9c1c7f4d377934ff4b2

                                                                                                      SHA1

                                                                                                      d0a329e387fb7bcba205364938417a67dbb4118a

                                                                                                      SHA256

                                                                                                      1649ec9493be27f76ae7304927d383f8a53dd3e41ea1678bacaff33120ea4170

                                                                                                      SHA512

                                                                                                      0fbe2843dfeab7373cde0643b20c073fdc2fcbefc5ae581fd1656c253dfa94e8bba4d348e95cc40d1e872456ecca894b462860aeac8b92cedb11a7cad634798c

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___docs_oracle_com_javase_8_docs

                                                                                                      Filesize

                                                                                                      36KB

                                                                                                      MD5

                                                                                                      8aaad0f4eb7d3c65f81c6e6b496ba889

                                                                                                      SHA1

                                                                                                      231237a501b9433c292991e4ec200b25c1589050

                                                                                                      SHA256

                                                                                                      813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1

                                                                                                      SHA512

                                                                                                      1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LLDJA3WI\microsoft.windows[1].xml

                                                                                                      Filesize

                                                                                                      97B

                                                                                                      MD5

                                                                                                      372706547a804b876522fe741dbfc040

                                                                                                      SHA1

                                                                                                      9bca733d6804f24c6841ef02b52e8ade1b45d7e4

                                                                                                      SHA256

                                                                                                      09fe1eb66c953d75dc66ff6df9237cde5f419fb25fab6327de9cde6676219651

                                                                                                      SHA512

                                                                                                      cc8057de048bf5646e41bed6f01111328bceae9abb4282a4ee1be635d086b6b3647cb5cc17cc3564980e5e31342a767dc639e536edbd3720df6b35ac7ebce34a

                                                                                                    • C:\Users\Admin\AppData\Roaming\7915B\B64E.915

                                                                                                      Filesize

                                                                                                      996B

                                                                                                      MD5

                                                                                                      14e6f97e532812b76d487a3b7987f27e

                                                                                                      SHA1

                                                                                                      95541143606fb309aef98f82bf9de301c629d9f1

                                                                                                      SHA256

                                                                                                      6d1874433bab888c86eac8773acfa66990b1e8b7579461282897c561bacc3182

                                                                                                      SHA512

                                                                                                      3685f6db0bfa8df7c67bfd4143c1e272e639c5b5377cb9f8ff3e9ec51f32c42372c9e9ce8aca16c7a051220bbe6c0f7478cdc997955a1c1e77a88701232dcf9c

                                                                                                    • C:\Users\Admin\AppData\Roaming\7915B\B64E.915

                                                                                                      Filesize

                                                                                                      600B

                                                                                                      MD5

                                                                                                      af03452772ca7e0244cf63471ddb1c59

                                                                                                      SHA1

                                                                                                      f99c876f301d60e57639f61ffcd61e16c043c7e9

                                                                                                      SHA256

                                                                                                      1b46db560881d0c992b7efc78f1d3c5fc832f9ec707d9b6216e42866065020b2

                                                                                                      SHA512

                                                                                                      2df1f866892f6e80d3a1eeea095df734cb5783ec6e488d8727fe55e4c1fdd1e086cab53931fa3ae1ea3d02997e009eb27d79bb7c034928a9b549ae026938f3be

                                                                                                    • C:\Users\Admin\AppData\Roaming\7915B\B64E.915

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      e892bde3e97ecbab14a87911feb43484

                                                                                                      SHA1

                                                                                                      4948f3fc45caf3361a4313e800fb5e21c872f20b

                                                                                                      SHA256

                                                                                                      ba95275597006378abf06a60d7ef2046631389dbda0fc730d82ad9b8a2d14397

                                                                                                      SHA512

                                                                                                      03f343e1ad079c2ebb3a07d218c46af11f095ab1cbdd9ea67281b7957a0714d550ab4fc944a77e8ac58b3b4fe8de13281134222eca7a52e4a9a82303061048ff

                                                                                                    • C:\Users\Admin\AppData\Roaming\7915B\B64E.915

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      5b925d8b89f1cb701ad56231126f99f0

                                                                                                      SHA1

                                                                                                      f6dd6d82755776404f57b4082ddca21cc7a850e1

                                                                                                      SHA256

                                                                                                      43c4e9a63a2682b88696fb367c58c315fb8c7989f46edb06c19db4ae74ef68e5

                                                                                                      SHA512

                                                                                                      d2623bea7d1328f612a7190e45fcbfd3d53570d04fdae09e87a2e74ef92dbbe7f8b35ccb77df49bba551bf6caa9095916f401bb794c8b451f23c9737031b48de

                                                                                                    • memory/860-636-0x00000229E0290000-0x00000229E02B0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/860-647-0x00000229E08A0000-0x00000229E08C0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/860-624-0x00000229E02D0000-0x00000229E02F0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/860-619-0x00000229DF370000-0x00000229DF470000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/860-620-0x00000229DF370000-0x00000229DF470000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/1932-1207-0x0000000004160000-0x0000000004161000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2296-1328-0x0000000004D60000-0x0000000004D61000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2416-737-0x0000000000400000-0x000000000041D000-memory.dmp

                                                                                                      Filesize

                                                                                                      116KB

                                                                                                    • memory/2444-616-0x0000000004A70000-0x0000000004A71000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2704-940-0x0000024FBA570000-0x0000024FBA590000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/2704-923-0x0000024FB9450000-0x0000024FB9550000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/2704-951-0x0000024FBA980000-0x0000024FBA9A0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/2704-927-0x0000024FBA5B0000-0x0000024FBA5D0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/2704-922-0x0000024FB9450000-0x0000024FB9550000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/3056-15-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                      Filesize

                                                                                                      428KB

                                                                                                    • memory/3128-1-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                                      Filesize

                                                                                                      416KB

                                                                                                    • memory/3128-2-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                      Filesize

                                                                                                      428KB

                                                                                                    • memory/3128-1473-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                      Filesize

                                                                                                      428KB

                                                                                                    • memory/3128-11-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                      Filesize

                                                                                                      428KB

                                                                                                    • memory/3128-13-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                                      Filesize

                                                                                                      416KB

                                                                                                    • memory/3128-738-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                      Filesize

                                                                                                      428KB

                                                                                                    • memory/3128-115-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                      Filesize

                                                                                                      428KB

                                                                                                    • memory/3464-1235-0x0000019675C00000-0x0000019675C20000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/3464-1221-0x0000019675800000-0x0000019675820000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/3464-1208-0x0000019674700000-0x0000019674800000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/3464-1213-0x0000019675840000-0x0000019675860000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/3516-1067-0x000001D2445E0000-0x000001D244600000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/3516-1092-0x000001D2449B0000-0x000001D2449D0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/3516-1080-0x000001D2445A0000-0x000001D2445C0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/3652-460-0x00000000047D0000-0x00000000047D1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4196-920-0x0000000004420000-0x0000000004421000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4224-462-0x0000023B9ED00000-0x0000023B9EE00000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/4224-479-0x0000023B9FBE0000-0x0000023B9FC00000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4224-491-0x0000023BA01F0000-0x0000023BA0210000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4224-467-0x0000023B9FE20000-0x0000023B9FE40000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4224-463-0x0000023B9ED00000-0x0000023B9EE00000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/4292-1345-0x0000020CBCDA0000-0x0000020CBCDC0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4292-1334-0x0000020CBCDE0000-0x0000020CBCE00000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4292-1330-0x0000020CBC400000-0x0000020CBC500000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/4292-1366-0x0000020CBD8C0000-0x0000020CBD8E0000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4424-339-0x0000028952100000-0x0000028952120000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4424-322-0x0000028951D00000-0x0000028951D20000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4424-311-0x0000028951D40000-0x0000028951D60000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4424-306-0x0000028950D20000-0x0000028950E20000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/4632-304-0x0000000002A00000-0x0000000002A01000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4696-1474-0x0000000004260000-0x0000000004261000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4712-118-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                      Filesize

                                                                                                      428KB

                                                                                                    • memory/4712-117-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                      Filesize

                                                                                                      428KB

                                                                                                    • memory/4772-797-0x0000018524030000-0x0000018524050000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4772-774-0x0000018522B00000-0x0000018522C00000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/4772-773-0x0000018522B00000-0x0000018522C00000-memory.dmp

                                                                                                      Filesize

                                                                                                      1024KB

                                                                                                    • memory/4772-786-0x0000018523C20000-0x0000018523C40000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4772-778-0x0000018523C60000-0x0000018523C80000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/5088-772-0x0000000004840000-0x0000000004841000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/5116-1060-0x00000000047D0000-0x00000000047D1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB