Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    49s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/01/2025, 22:43

General

  • Target

    JaffaCakes118_445935e8d4c5f152a7b8ca19d7834a24.exe

  • Size

    285KB

  • MD5

    445935e8d4c5f152a7b8ca19d7834a24

  • SHA1

    4b6aa2b403769bfa48ac2852ed9df8c5a56baf04

  • SHA256

    6ad56abd94ebaf4c32e2d3c3558c375e5ed0d5c96b4195817695defd8052ea0a

  • SHA512

    1292afcb09be678cba33e8465bc47b244c84c1a82ce61d0f81b9c5223457596dc27c07e6899788df33b2d970f1fa478f899027216ba2578815ef1d89f34358af

  • SSDEEP

    6144:k2m8z+xMfMCTWxjjRN0ueonKyMohMh0AvzVnVQrSH15i:Y8z+xMfMCixhSchMh3vpnOO

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

  • Cycbot family
  • Detects Cycbot payload 8 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
  • Pony family
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables taskbar notifications via registry modification
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 12 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_445935e8d4c5f152a7b8ca19d7834a24.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_445935e8d4c5f152a7b8ca19d7834a24.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5032
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_445935e8d4c5f152a7b8ca19d7834a24.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_445935e8d4c5f152a7b8ca19d7834a24.exe startC:\Users\Admin\AppData\Roaming\46747\9217E.exe%C:\Users\Admin\AppData\Roaming\46747
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2200
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_445935e8d4c5f152a7b8ca19d7834a24.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_445935e8d4c5f152a7b8ca19d7834a24.exe startC:\Program Files (x86)\47BEB\lvvm.exe%C:\Program Files (x86)\47BEB
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2164
    • C:\Program Files (x86)\LP\7E04\77D.tmp
      "C:\Program Files (x86)\LP\7E04\77D.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1028
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4868
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2336
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1076
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:560
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3356
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4132
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:720
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1932
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:2100
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4092
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3224
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3228
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1616
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4888
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3540
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5080
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3860
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    PID:4180
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:2980
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:1820
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:468
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:3960
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:4108
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:808
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:2200
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:4176
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:8
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:1688
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:5048
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:3188
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:1592
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:4432
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4940
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:3680
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:4356
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:2968
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:1356
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:228
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:2980
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:3820
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:3204
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4880
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:3688
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:3808
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3724
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:3684
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:3476
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:2076
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:3096
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:4272
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:4136
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:4860
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:1664
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:5004
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:1060
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:2468
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:4092
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:3744
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:4216
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:3516
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:4440
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:4316
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:2968
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:2224
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:1056
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:4444
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:3948
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:1948
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:2812
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:2808
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                            1⤵
                                                                                                              PID:4296
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:4128
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:3556
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                  1⤵
                                                                                                                    PID:4080
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:4048
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                      1⤵
                                                                                                                        PID:1920
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                        1⤵
                                                                                                                          PID:2688
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe
                                                                                                                          1⤵
                                                                                                                            PID:1688

                                                                                                                          Network

                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          • C:\Program Files (x86)\LP\7E04\77D.tmp

                                                                                                                            Filesize

                                                                                                                            99KB

                                                                                                                            MD5

                                                                                                                            e30776fd4c002156aa05dcbe4157fc63

                                                                                                                            SHA1

                                                                                                                            77dc074bfc544251555ded2ad9ec741e7b88babe

                                                                                                                            SHA256

                                                                                                                            e115c9b0524257ca624e0123ebb7cbe77cf09edb33bfed015038e95b94a8e1c8

                                                                                                                            SHA512

                                                                                                                            cecac46a434ef0ddafe78252ee0b38607cd0c10f83f658f4b3259d5cf8c3779fc5cf8facbf9cfb0e218f7c67dc8baff27c4f5349bacda8bf21e212a3c47e4dbf

                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                                            Filesize

                                                                                                                            471B

                                                                                                                            MD5

                                                                                                                            f0c8ea8d96ee2b2e15819d3a9e1e5cbd

                                                                                                                            SHA1

                                                                                                                            558d31ce0a86b5b4e76db25334779c4163315ded

                                                                                                                            SHA256

                                                                                                                            489b72d5dae88c38017aea37be6fea088ffaa50e10b584c0685c3bcb5a847a32

                                                                                                                            SHA512

                                                                                                                            6a1109f21311662016a1ed620fb1ae35c4f24754f0f96dda4948ef5bf9c70e76c39a021ec4b2b79c84dad5d859a5b2f0422ab4f6641895cad5d1461549879637

                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                                            Filesize

                                                                                                                            412B

                                                                                                                            MD5

                                                                                                                            27158fa4d299ae48d80f3368cb3886d3

                                                                                                                            SHA1

                                                                                                                            e6023663a5a2c19f3e011c7a64a6bfbc97b1ab4c

                                                                                                                            SHA256

                                                                                                                            ce011b3835487684ec952f9f929c6a9a0771bc3069e3dc4524f0241bea4c8041

                                                                                                                            SHA512

                                                                                                                            588faa1b25b8f028e0c4da7b2327fa8f4f73b7f584eae85c98be7c79225dcc92a75682e7d73ac995d45f80bd40ce774b9363ec004ecf285699b5a3f4acf1fe74

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                                            Filesize

                                                                                                                            2KB

                                                                                                                            MD5

                                                                                                                            883623d0cddb24a3ce7d108cbec695c0

                                                                                                                            SHA1

                                                                                                                            10205f48bcf7163c7863550c3dddfc402564fcbc

                                                                                                                            SHA256

                                                                                                                            76434ab2d6f500a53d3f351a4c52a9c724230cd95950f976bc3156db3016b990

                                                                                                                            SHA512

                                                                                                                            0c5ee954506779b7a4e1738cb95d13514e760c31c271f1ed722b1043b1b21786796ae6fbbcf76f3f25ad0535d700265c16218edc32bbd690af5c0e4459b1745d

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{2F519BF2-C697-59F8-8F6A-1E19509CE66B}

                                                                                                                            Filesize

                                                                                                                            36KB

                                                                                                                            MD5

                                                                                                                            8aaad0f4eb7d3c65f81c6e6b496ba889

                                                                                                                            SHA1

                                                                                                                            231237a501b9433c292991e4ec200b25c1589050

                                                                                                                            SHA256

                                                                                                                            813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1

                                                                                                                            SHA512

                                                                                                                            1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer

                                                                                                                            Filesize

                                                                                                                            36KB

                                                                                                                            MD5

                                                                                                                            ab0262f72142aab53d5402e6d0cb5d24

                                                                                                                            SHA1

                                                                                                                            eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                                                                            SHA256

                                                                                                                            20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                                                                            SHA512

                                                                                                                            bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2C1DWAXK\microsoft.windows[1].xml

                                                                                                                            Filesize

                                                                                                                            96B

                                                                                                                            MD5

                                                                                                                            e348d00fe7b19d8e8f6efc5cd8f3be59

                                                                                                                            SHA1

                                                                                                                            de85b87da07da2e4b4215ef312d318f1b329ca6e

                                                                                                                            SHA256

                                                                                                                            4ee26da36e3b7d5c9f14f2ed8d6c75c10434acec949dc6e550f176b9acb84dd7

                                                                                                                            SHA512

                                                                                                                            a0a9a671e08cb35904098426cf1b50a11d6a0c7be57f684f9808f5c953ac2732dd1f090c3d12260870056a1ee5f9097ad9872715c798fba196d7212a536afcbe

                                                                                                                          • C:\Users\Admin\AppData\Roaming\46747\7BEB.674

                                                                                                                            Filesize

                                                                                                                            996B

                                                                                                                            MD5

                                                                                                                            856e82d3c9f316b0e78ac963a433495d

                                                                                                                            SHA1

                                                                                                                            29759b35051745c9ad4a7d83f5646ebc15e5501b

                                                                                                                            SHA256

                                                                                                                            0d1dd62c3c8ff33518e0692f77e41bdc374191f533f19565826d555ba8c0e4be

                                                                                                                            SHA512

                                                                                                                            26474e53dfdc470ae65af329a24e5bc5c17cac2a6bac33e3972ef737399e817d4aea85ac2d0b70de4260dd38a4f3113fb4fc3bb574f356244c8093b0c2cf8e25

                                                                                                                          • C:\Users\Admin\AppData\Roaming\46747\7BEB.674

                                                                                                                            Filesize

                                                                                                                            1KB

                                                                                                                            MD5

                                                                                                                            afb7864e246d0669e44e6c1a751ba6b4

                                                                                                                            SHA1

                                                                                                                            db40c0bed7411bd6ae7789ed5fb77343b04927ac

                                                                                                                            SHA256

                                                                                                                            4a7e06b37fc4819da8af39df08b06dfd738b7e48e68816e8aab24e0063ebde03

                                                                                                                            SHA512

                                                                                                                            7dc9c2d72046ad9db8ded7af313ea9f6e118406a8bb630bfbd0df1bd0dc31fa50c332f7e50e73747d2b3b439d5b6ed1d457c65d61a9f110ac6554be759051825

                                                                                                                          • C:\Users\Admin\AppData\Roaming\46747\7BEB.674

                                                                                                                            Filesize

                                                                                                                            300B

                                                                                                                            MD5

                                                                                                                            e553233a6d6e3dc7a1808a62cf033ce7

                                                                                                                            SHA1

                                                                                                                            255e66d36ca6dbbe8842c6fb64fb58bb33b3fb5d

                                                                                                                            SHA256

                                                                                                                            c5352a26e0edc1301d5688a3502887038fd4620fe8680ac958e44091dcbc5c68

                                                                                                                            SHA512

                                                                                                                            db93d1e0bd4812a3d30696369ef6e41bf8fefce453760fdf4d6de136b3b8218bfc7861b381f5854d0e88d2a64241cf91603a920b7119352d3fc72cd71fc83068

                                                                                                                          • C:\Users\Admin\AppData\Roaming\46747\7BEB.674

                                                                                                                            Filesize

                                                                                                                            600B

                                                                                                                            MD5

                                                                                                                            306f79d3a5aeb8eb1151fe8a0fcdec58

                                                                                                                            SHA1

                                                                                                                            785eb7039f1d3713338ca443a8fe7a1541cc69ee

                                                                                                                            SHA256

                                                                                                                            11ef4b844ed47685b5601f3daf95a2050e4b3a208bc27d19a44b7bcf1f3c0c7c

                                                                                                                            SHA512

                                                                                                                            df55689a62c6a72487341fa6cd41c32b9aeb0bf4da02ed1fb11965b513cbf5835c4137fcf54ec5910718747ec355514ec8a91a7bb35f5ee1d0f415e2aff972b6

                                                                                                                          • memory/8-1402-0x0000000004B00000-0x0000000004B01000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/468-1101-0x0000000004B90000-0x0000000004B91000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/808-1250-0x0000000003690000-0x0000000003691000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/1028-653-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            112KB

                                                                                                                          • memory/1820-962-0x0000023157870000-0x0000023157890000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1820-993-0x0000023157830000-0x0000023157850000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1820-994-0x0000023157C40000-0x0000023157C60000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1820-957-0x0000023156720000-0x0000023156820000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                          • memory/1820-958-0x0000023156720000-0x0000023156820000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                          • memory/1820-959-0x0000023156720000-0x0000023156820000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                          • memory/1932-360-0x00000241A7A40000-0x00000241A7B40000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                          • memory/1932-364-0x00000241A8A70000-0x00000241A8A90000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1932-365-0x00000241A8A30000-0x00000241A8A50000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1932-377-0x00000241A8E40000-0x00000241A8E60000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/1932-359-0x00000241A7A40000-0x00000241A7B40000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                          • memory/2100-513-0x0000000004C60000-0x0000000004C61000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/2164-181-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            428KB

                                                                                                                          • memory/2200-60-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            428KB

                                                                                                                          • memory/2200-63-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            428KB

                                                                                                                          • memory/2200-61-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            428KB

                                                                                                                          • memory/3188-1548-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/3224-517-0x0000012669000000-0x0000012669100000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                          • memory/3224-516-0x0000012669000000-0x0000012669100000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                          • memory/3224-515-0x0000012669000000-0x0000012669100000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                          • memory/3224-520-0x0000012669EE0000-0x0000012669F00000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/3224-543-0x000001266A4C0000-0x000001266A4E0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/3224-531-0x0000012669EA0000-0x0000012669EC0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/3228-656-0x0000000003020000-0x0000000003021000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/3540-806-0x00000000041F0000-0x00000000041F1000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/3860-835-0x000001BA25710000-0x000001BA25730000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/3860-808-0x000001BA24200000-0x000001BA24300000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                          • memory/3860-807-0x000001BA24200000-0x000001BA24300000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                          • memory/3860-812-0x000001BA25340000-0x000001BA25360000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/3860-822-0x000001BA25300000-0x000001BA25320000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4108-1103-0x00000201C5600000-0x00000201C5700000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                          • memory/4108-1102-0x00000201C5600000-0x00000201C5700000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                          • memory/4108-1132-0x00000201C6AE0000-0x00000201C6B00000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4108-1120-0x00000201C61C0000-0x00000201C61E0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4108-1107-0x00000201C6500000-0x00000201C6520000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4132-358-0x00000000049B0000-0x00000000049B1000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/4176-1258-0x000001F085EE0000-0x000001F085F00000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4176-1289-0x000001F0864C0000-0x000001F0864E0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4176-1269-0x000001F085EA0000-0x000001F085EC0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4180-955-0x0000000004840000-0x0000000004841000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            4KB

                                                                                                                          • memory/4888-660-0x00000203BB600000-0x00000203BB700000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                          • memory/4888-659-0x00000203BB600000-0x00000203BB700000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                          • memory/4888-663-0x00000203BC510000-0x00000203BC530000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4888-658-0x00000203BB600000-0x00000203BB700000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                          • memory/4888-685-0x00000203BCAE0000-0x00000203BCB00000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/4888-672-0x00000203BC4D0000-0x00000203BC4F0000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/5032-1547-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            428KB

                                                                                                                          • memory/5032-655-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            428KB

                                                                                                                          • memory/5032-179-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            428KB

                                                                                                                          • memory/5032-1-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            416KB

                                                                                                                          • memory/5032-2-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            428KB

                                                                                                                          • memory/5032-57-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            428KB

                                                                                                                          • memory/5032-59-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            416KB

                                                                                                                          • memory/5048-1404-0x000002A9E1D00000-0x000002A9E1E00000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB

                                                                                                                          • memory/5048-1417-0x000002A9E2E20000-0x000002A9E2E40000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/5048-1431-0x000002A9E3230000-0x000002A9E3250000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/5048-1409-0x000002A9E2E60000-0x000002A9E2E80000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            128KB

                                                                                                                          • memory/5048-1405-0x000002A9E1D00000-0x000002A9E1E00000-memory.dmp

                                                                                                                            Filesize

                                                                                                                            1024KB