Analysis

  • max time kernel
    69s
  • max time network
    67s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/04/2024, 06:41

General

  • Target

    0035b70154f2e1df4c3cda8e8fb24b8f_JaffaCakes118.exe

  • Size

    2.6MB

  • MD5

    0035b70154f2e1df4c3cda8e8fb24b8f

  • SHA1

    16cc481a1fb6f88cb014474876e0854836619307

  • SHA256

    a19dff42e4fada2ded22aed776b1a2742413e04faeee76c171d3ee6ef63ad787

  • SHA512

    a0c8d9f3cf18a61025364adffd6f15d3e64588e4b3a768597ca237fddc44c94ce08176f4394d5a240ff3a07526a9fdd8282e2d1e2d2d4a3e3432645801634b2e

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlM:86SIROiFJiwp0xlrlM

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 39 IoCs
  • Drops file in Windows directory 45 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 43 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0035b70154f2e1df4c3cda8e8fb24b8f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0035b70154f2e1df4c3cda8e8fb24b8f_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3624
    • C:\Users\Admin\AppData\Local\Temp\0035b70154f2e1df4c3cda8e8fb24b8f_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\0035b70154f2e1df4c3cda8e8fb24b8f_JaffaCakes118.exe"
      2⤵
      • Drops startup file
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2728
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:4920
        • C:\Users\Admin\AppData\Local\Temp\0035b70154f2e1df4c3cda8e8fb24b8f_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\0035b70154f2e1df4c3cda8e8fb24b8f_JaffaCakes118.exe"
          3⤵
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4444
          • \??\c:\windows\system\explorer.exe
            c:\windows\system\explorer.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Drops file in Windows directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3144
            • \??\c:\windows\system\explorer.exe
              c:\windows\system\explorer.exe
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • Suspicious use of WriteProcessMemory
              PID:1564
              • \??\c:\windows\system\explorer.exe
                "c:\windows\system\explorer.exe"
                6⤵
                • Modifies WinLogon for persistence
                • Modifies visiblity of hidden/system files in Explorer
                • Modifies Installed Components in the registry
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1652
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:5056
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    PID:4868
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2200
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    PID:3620
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:452
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    PID:2176
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:3388
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    PID:3608
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:1740
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:1128
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:2316
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:4984
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:2108
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:2656
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:2076
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:1576
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:1604
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:4016
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:4600
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:224
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:1248
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:4788
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:4508
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:3712
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:1544
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:4840
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:2212
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:2164
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:4436
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:2868
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:3448
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:4252
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:1996
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:940
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:2088
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:5008
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:3020
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:3736
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:4496
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:4360
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:452
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:2408
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:2928
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:3248
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:1420
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:4320
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:4400
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:4768
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:1136
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:1860
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:1912
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:452
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:2344
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:2668
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:4344
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:2864
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:4364
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:1752
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:868
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                    • Executes dropped EXE
                    PID:2564
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  PID:2136
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    8⤵
                      PID:1764
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    7⤵
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • Suspicious use of SetWindowsHookEx
                    PID:2108
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      8⤵
                        PID:4508
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      7⤵
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • Suspicious use of SetWindowsHookEx
                      PID:4456
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        8⤵
                          PID:5200
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        7⤵
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        • Suspicious use of SetWindowsHookEx
                        PID:5288
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          8⤵
                            PID:5332
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          7⤵
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          • Suspicious use of SetWindowsHookEx
                          PID:5448
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            8⤵
                              PID:5636
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            7⤵
                              PID:5744
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                8⤵
                                  PID:5808
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                7⤵
                                  PID:5876
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    8⤵
                                      PID:5920
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    7⤵
                                      PID:5968
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        8⤵
                                          PID:6004
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        7⤵
                                          PID:6052
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            8⤵
                                              PID:6080
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            7⤵
                                              PID:6128
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                8⤵
                                                  PID:2760
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                7⤵
                                                  PID:720
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    8⤵
                                                      PID:3472
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    7⤵
                                                      PID:5172
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe SE
                                                        8⤵
                                                          PID:5216
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe SE
                                                        7⤵
                                                          PID:5240
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            8⤵
                                                              PID:5312
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            7⤵
                                                              PID:5408
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                8⤵
                                                                  PID:5416
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                7⤵
                                                                  PID:5484
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe SE
                                                                    8⤵
                                                                      PID:5556
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe SE
                                                                    7⤵
                                                                      PID:5620
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        8⤵
                                                                          PID:544
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        7⤵
                                                                          PID:5644
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            8⤵
                                                                              PID:5456
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            7⤵
                                                                              PID:5788
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                8⤵
                                                                                  PID:5836
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                7⤵
                                                                                  PID:6068
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    8⤵
                                                                                      PID:5136
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    7⤵
                                                                                      PID:4524
                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                        8⤵
                                                                                          PID:5496
                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                        7⤵
                                                                                          PID:5484
                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                            8⤵
                                                                                              PID:5668
                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                            7⤵
                                                                                              PID:5824
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                8⤵
                                                                                                  PID:5760
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                7⤵
                                                                                                  PID:6056
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                    8⤵
                                                                                                      PID:5400
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                    7⤵
                                                                                                      PID:5708
                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                        8⤵
                                                                                                          PID:5900
                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                        7⤵
                                                                                                          PID:6032
                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                            8⤵
                                                                                                              PID:6088
                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                            7⤵
                                                                                                              PID:4892
                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                8⤵
                                                                                                                  PID:3732
                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                7⤵
                                                                                                                  PID:5188
                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                    8⤵
                                                                                                                      PID:5388
                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                    7⤵
                                                                                                                      PID:5280
                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                        8⤵
                                                                                                                          PID:5528
                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                        7⤵
                                                                                                                          PID:2572
                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                            8⤵
                                                                                                                              PID:5968
                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                            7⤵
                                                                                                                              PID:6128
                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                8⤵
                                                                                                                                  PID:5128
                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                7⤵
                                                                                                                                  PID:5412
                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                    8⤵
                                                                                                                                      PID:5188
                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                    7⤵
                                                                                                                                      PID:5792
                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                        8⤵
                                                                                                                                          PID:5992
                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                        7⤵
                                                                                                                                          PID:5932
                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                            8⤵
                                                                                                                                              PID:3444
                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                            7⤵
                                                                                                                                              PID:5576
                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                8⤵
                                                                                                                                                  PID:5460
                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                7⤵
                                                                                                                                                  PID:5280
                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                    8⤵
                                                                                                                                                      PID:3636
                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                    7⤵
                                                                                                                                                      PID:5412
                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                        8⤵
                                                                                                                                                          PID:5304
                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                        7⤵
                                                                                                                                                          PID:6292
                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                            8⤵
                                                                                                                                                              PID:6316
                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                            7⤵
                                                                                                                                                              PID:6404
                                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                                8⤵
                                                                                                                                                                  PID:6436
                                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                                7⤵
                                                                                                                                                                  PID:6504
                                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                                    8⤵
                                                                                                                                                                      PID:6532
                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                        C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                                                                                                                                        1⤵
                                                                                                                                                          PID:2400

                                                                                                                                                        Network

                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                              Replay Monitor

                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                              Downloads

                                                                                                                                                              • C:\Windows\Parameters.ini

                                                                                                                                                                Filesize

                                                                                                                                                                74B

                                                                                                                                                                MD5

                                                                                                                                                                6687785d6a31cdf9a5f80acb3abc459b

                                                                                                                                                                SHA1

                                                                                                                                                                1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                                                                                                                                                SHA256

                                                                                                                                                                3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                                                                                                                                                SHA512

                                                                                                                                                                5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                                                                                                                                              • C:\Windows\System\explorer.exe

                                                                                                                                                                Filesize

                                                                                                                                                                2.6MB

                                                                                                                                                                MD5

                                                                                                                                                                5b5345b483169cb0b373f1d59ece6f59

                                                                                                                                                                SHA1

                                                                                                                                                                842b921105817c0ac07fa74fd5c7591485df700c

                                                                                                                                                                SHA256

                                                                                                                                                                6480ad2d1de0211725bfad37d5ec251e91a439e8b8f5f3bb0861705524d04b1b

                                                                                                                                                                SHA512

                                                                                                                                                                5436b999dc496ea92d44ea014ec05dfd2d49ff007c17f5a6b2918bd416ce3f64d23daff48401c0c5c57206f08a5ad5ac6cadc3be1ef13ff0fe8dd684e028a959

                                                                                                                                                              • C:\Windows\System\spoolsv.exe

                                                                                                                                                                Filesize

                                                                                                                                                                2.6MB

                                                                                                                                                                MD5

                                                                                                                                                                a9c027b9153308f296f4ef01f34a3c49

                                                                                                                                                                SHA1

                                                                                                                                                                6e8aeb12ed2810ab702a415c5d236314afda3607

                                                                                                                                                                SHA256

                                                                                                                                                                82a5a5ac69125db922978397cb25e6324d8817ad4506e4670ff5cd9094064386

                                                                                                                                                                SHA512

                                                                                                                                                                19780cf1bfa72df43d5c63420615452d1622856448a82c9338e876c41f8d6a79c2cc998133ddcddff6306a37a4e09427e150c7d4a6fab205ae7eb28a7b6910bb

                                                                                                                                                              • memory/224-232-0x0000000000680000-0x0000000000681000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/224-231-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/452-147-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/452-142-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/1128-174-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/1128-213-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/1128-172-0x0000000002200000-0x0000000002201000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/1248-242-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/1248-238-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/1564-67-0x0000000000770000-0x0000000000771000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/1564-62-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/1564-64-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/1564-99-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/1564-101-0x0000000000770000-0x0000000000771000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/1564-105-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/1576-209-0x0000000000760000-0x0000000000761000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/1576-208-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/1576-254-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/1604-215-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/1604-219-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/1652-160-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                248KB

                                                                                                                                                              • memory/1652-106-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                248KB

                                                                                                                                                              • memory/1740-170-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/1740-165-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/2076-203-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/2076-207-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/2108-189-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/2108-193-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/2176-148-0x0000000000870000-0x0000000000871000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2176-195-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/2176-149-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/2200-131-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/2200-136-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/2316-182-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/2316-177-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/2656-236-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/2656-197-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/2656-198-0x0000000000860000-0x0000000000861000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2728-7-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/2728-6-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/2728-8-0x0000000002470000-0x0000000002471000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2728-39-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/2728-41-0x0000000002470000-0x0000000002471000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/2728-4-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/2728-3-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/2728-47-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/3144-58-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/3144-63-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/3388-159-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/3388-153-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/3608-161-0x0000000002200000-0x0000000002201000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/3608-158-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/3608-201-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/3620-137-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/3620-183-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/3620-138-0x0000000000690000-0x0000000000691000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/3624-5-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/3624-2-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/4016-220-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/4016-221-0x0000000000760000-0x0000000000761000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/4444-42-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                248KB

                                                                                                                                                              • memory/4444-44-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                248KB

                                                                                                                                                              • memory/4444-65-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                248KB

                                                                                                                                                              • memory/4508-253-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/4508-248-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/4600-229-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/4788-243-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/4788-244-0x0000000000690000-0x0000000000691000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/4868-128-0x0000000000760000-0x0000000000761000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/4868-122-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/4868-126-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/4868-171-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/4984-185-0x0000000000760000-0x0000000000761000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/4984-184-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/4984-225-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                              • memory/5056-125-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                              • memory/5056-118-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB