Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26/04/2024, 10:33

General

  • Target

    0092221b95e48288f229f48cd6514444_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    0092221b95e48288f229f48cd6514444

  • SHA1

    2190749d8d96486ca2b2b33f7dc2ada4b61594f8

  • SHA256

    71ed80b561d3b7e5b5b3bf3ff6bcd0c51c4f899aad0c1e71e10e5974d38b933d

  • SHA512

    45915c4f61c2da53ad234736b2dab4303d2b7ae72487daabe3e57c9b15afec457bb328b32cdbe1b30bffb5c36da1ec573bee9989a755e3887f91ad152c42d31d

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZe:0UzeyQMS4DqodCnoe+iitjWwwy

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0092221b95e48288f229f48cd6514444_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0092221b95e48288f229f48cd6514444_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2084
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2180
      • C:\Users\Admin\AppData\Local\Temp\0092221b95e48288f229f48cd6514444_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\0092221b95e48288f229f48cd6514444_JaffaCakes118.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2416
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:2384
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1588
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:108
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                  PID:4844
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                PID:2848
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                    PID:4896
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  PID:1616
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                      PID:6024
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    PID:1244
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                        PID:5696
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      PID:1940
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                          PID:6912
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        PID:1620
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                            PID:6772
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          PID:2492
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:7008
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            PID:2860
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:7000
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              PID:2128
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                  PID:7160
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                PID:2008
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                PID:1416
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                PID:2716
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                PID:808
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                    PID:4180
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:2300
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                      PID:7084
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Executes dropped EXE
                                    PID:2292
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Executes dropped EXE
                                    PID:2544
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                        PID:7132
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:332
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2012
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1784
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2304
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2236
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:2600
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2392
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:1548
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2832
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:936
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2000
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:1848
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2644
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:1268
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:1228
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:400
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:276
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1636
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:2436
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:2320
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:448
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:956
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1796
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2504
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2032
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:2984
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1640
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:2516
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2660
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:484
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1292
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:2592
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1424
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1772
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:900
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1972
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:1248
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2472
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1264
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:840
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2836
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1560
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:2348
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:1556
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1888
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:1976
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Drops file in Windows directory
                                      PID:2540
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Drops file in Windows directory
                                      PID:768
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                        PID:772
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                          PID:1504
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          PID:888
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                            PID:1544
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                            • Drops file in Windows directory
                                            PID:2952
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                              PID:1104
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Drops file in Windows directory
                                              PID:1136
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                                PID:2040
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:3156
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                  PID:3320
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                    PID:3484
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                    • Drops file in Windows directory
                                                    PID:3656
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                      PID:3824
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                        PID:3996
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe SE
                                                        5⤵
                                                          PID:3096
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                            PID:3264
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                            • Drops file in Windows directory
                                                            PID:3456
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                              PID:3644
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Drops file in Windows directory
                                                              PID:3844
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                                PID:4048
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                5⤵
                                                                • Drops file in Windows directory
                                                                PID:3144
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                5⤵
                                                                • Drops file in Windows directory
                                                                PID:3388
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                5⤵
                                                                • Drops file in Windows directory
                                                                PID:3596
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                5⤵
                                                                  PID:3796
                                                                • \??\c:\windows\system\spoolsv.exe
                                                                  c:\windows\system\spoolsv.exe SE
                                                                  5⤵
                                                                    PID:4004
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe SE
                                                                    5⤵
                                                                      PID:3172
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                        PID:3404
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                          PID:3608
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                            PID:3836
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                              PID:1884
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe SE
                                                                              5⤵
                                                                                PID:3304
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                  PID:3548
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                    PID:3788
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    5⤵
                                                                                    • Drops file in Windows directory
                                                                                    PID:4076
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    5⤵
                                                                                      PID:3192
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      5⤵
                                                                                      • Drops file in Windows directory
                                                                                      PID:3504
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      5⤵
                                                                                        PID:3868
                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                        5⤵
                                                                                          PID:3108
                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                          5⤵
                                                                                            PID:2828
                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                            5⤵
                                                                                              PID:3684
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              5⤵
                                                                                              • Drops file in Windows directory
                                                                                              PID:3940
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              5⤵
                                                                                                PID:3432
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                5⤵
                                                                                                  PID:3740
                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                  5⤵
                                                                                                    PID:3076
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                    5⤵
                                                                                                      PID:1412
                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                      5⤵
                                                                                                        PID:3936
                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                        5⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:3312
                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                        5⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:3688
                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                        5⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:3240
                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                        5⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:3612
                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                        5⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:3256
                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                        5⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:3912
                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                        5⤵
                                                                                                          PID:3588
                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                          5⤵
                                                                                                            PID:1204
                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                            5⤵
                                                                                                              PID:4068
                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                              5⤵
                                                                                                                PID:3904
                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                5⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                PID:3624
                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                5⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                PID:3960
                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                5⤵
                                                                                                                  PID:2460
                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                  5⤵
                                                                                                                    PID:3784
                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                    5⤵
                                                                                                                      PID:3792
                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                      5⤵
                                                                                                                        PID:3872
                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                        5⤵
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:4148
                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                        5⤵
                                                                                                                          PID:4320
                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                          5⤵
                                                                                                                            PID:4488
                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                            5⤵
                                                                                                                            • Drops file in Windows directory
                                                                                                                            PID:4656
                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                            5⤵
                                                                                                                              PID:4812
                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                              5⤵
                                                                                                                              • Drops file in Windows directory
                                                                                                                              PID:4976
                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                              5⤵
                                                                                                                                PID:3728
                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                5⤵
                                                                                                                                  PID:4272
                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                  5⤵
                                                                                                                                    PID:4464
                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                    5⤵
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:4648
                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                    5⤵
                                                                                                                                      PID:4848
                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                      5⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:5028
                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                      5⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:4196
                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                      5⤵
                                                                                                                                        PID:4384
                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                        5⤵
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:4620
                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                        5⤵
                                                                                                                                          PID:4824
                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                          5⤵
                                                                                                                                            PID:5032
                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                            5⤵
                                                                                                                                              PID:4216
                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                              5⤵
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:4444
                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                              5⤵
                                                                                                                                                PID:4720
                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                5⤵
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:4964
                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                5⤵
                                                                                                                                                  PID:4136
                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                                  5⤵
                                                                                                                                                    PID:4420
                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                    5⤵
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:4712
                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                    5⤵
                                                                                                                                                      PID:5008
                                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                                      5⤵
                                                                                                                                                        PID:4248
                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                        5⤵
                                                                                                                                                          PID:4552
                                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                                          5⤵
                                                                                                                                                            PID:4900
                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                            5⤵
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:4132
                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                            5⤵
                                                                                                                                                              PID:4512
                                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                                              5⤵
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              PID:4864
                                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                                              5⤵
                                                                                                                                                                PID:4156
                                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                                5⤵
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:4596
                                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:4992
                                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:4368
                                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:4796
                                                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:4192
                                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:4820
                                                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:4428
                                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:5748
                                                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:6788

                                                                                                                                                                      Network

                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                            Replay Monitor

                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                            Downloads

                                                                                                                                                                            • C:\Windows\Parameters.ini

                                                                                                                                                                              Filesize

                                                                                                                                                                              74B

                                                                                                                                                                              MD5

                                                                                                                                                                              6687785d6a31cdf9a5f80acb3abc459b

                                                                                                                                                                              SHA1

                                                                                                                                                                              1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                                                                                                                                                              SHA256

                                                                                                                                                                              3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                                                                                                                                                              SHA512

                                                                                                                                                                              5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                                                                                                                                                            • \Windows\system\explorer.exe

                                                                                                                                                                              Filesize

                                                                                                                                                                              2.2MB

                                                                                                                                                                              MD5

                                                                                                                                                                              4441e848167beac220d7bd6ba089ea70

                                                                                                                                                                              SHA1

                                                                                                                                                                              f86d37e96267d7459d7ab07b847b95da89f6ac95

                                                                                                                                                                              SHA256

                                                                                                                                                                              5e2cce8fef436007bc7717e051f57d14e89fb322e1f1604906998cfadd24c175

                                                                                                                                                                              SHA512

                                                                                                                                                                              6cbca40c832f6cfd39b9c7c5ef745260aa87d91e454b7b082c253c6c8857b739a3c0af64b32d1eeaad0cb691ddd27d6a645525f7a6005dac956828ff0777a1d8

                                                                                                                                                                            • \Windows\system\spoolsv.exe

                                                                                                                                                                              Filesize

                                                                                                                                                                              2.2MB

                                                                                                                                                                              MD5

                                                                                                                                                                              500736b488b14e6e434738e5045c01d0

                                                                                                                                                                              SHA1

                                                                                                                                                                              bd478486c57fdb8a945c82a150b0adb483900ec2

                                                                                                                                                                              SHA256

                                                                                                                                                                              feb96c750211c9ac886983ceff322ad93333cf5ad7e75f419cb993c2f53ba2a5

                                                                                                                                                                              SHA512

                                                                                                                                                                              96146898cd18340fd8fe81264bcf6cf4f02cedd97e952223bf38766cfd7225a360653609b4d34ad49dbb67495f81595b2e728dc5ebe56dc80165583c977aab04

                                                                                                                                                                            • memory/108-2419-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/108-467-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/108-87-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/276-1253-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/332-681-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/332-1040-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/332-3117-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/400-1582-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/400-1216-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/448-1401-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/808-902-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/808-540-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/808-3011-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/936-1010-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/936-3378-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/936-1360-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/956-1433-0x0000000000230000-0x0000000000231000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/1244-2610-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/1244-194-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/1244-571-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/1268-1505-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/1268-3490-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/1268-1156-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/1416-2968-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/1416-825-0x0000000000230000-0x0000000000231000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/1416-468-0x0000000000230000-0x0000000000231000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/1548-936-0x00000000003C0000-0x00000000003C1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/1548-1287-0x00000000003C0000-0x00000000003C1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/1548-3341-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/1588-435-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              248KB

                                                                                                                                                                            • memory/1588-77-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              248KB

                                                                                                                                                                            • memory/1616-2528-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/1616-534-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/1616-151-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/1620-643-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/1620-2676-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/1620-283-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/1636-1288-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/1784-3191-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/1796-1472-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/1848-3415-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/1940-2638-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/1940-238-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/1940-607-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2000-3414-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2000-1397-0x00000000002A0000-0x00000000002A1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2000-1041-0x00000000002A0000-0x00000000002A1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2008-789-0x00000000003B0000-0x00000000003B1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2008-2931-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2008-436-0x00000000003B0000-0x00000000003B1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2012-3154-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2032-1542-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2084-27-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2084-0-0x0000000000320000-0x0000000000321000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2084-19-0x0000000000320000-0x0000000000321000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2084-17-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2128-409-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2128-758-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2128-2861-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2236-3225-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2292-3081-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2292-612-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2292-970-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2300-3049-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2304-1147-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2304-790-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2304-3192-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2320-1361-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2384-42-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2384-61-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2384-63-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2384-72-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2392-903-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2392-3299-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2392-1252-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2416-50-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              248KB

                                                                                                                                                                            • memory/2416-20-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              248KB

                                                                                                                                                                            • memory/2416-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2416-24-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              248KB

                                                                                                                                                                            • memory/2416-28-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              248KB

                                                                                                                                                                            • memory/2416-31-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              248KB

                                                                                                                                                                            • memory/2492-327-0x0000000000230000-0x0000000000231000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2492-2758-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2492-680-0x0000000000230000-0x0000000000231000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2504-1506-0x0000000000320000-0x0000000000321000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2544-3116-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2544-644-0x00000000003B0000-0x00000000003B1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2544-1009-0x00000000003B0000-0x00000000003B1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2600-3267-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2600-1215-0x0000000000260000-0x0000000000261000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2600-861-0x0000000000260000-0x0000000000261000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2644-3448-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2716-860-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2716-498-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2716-2979-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2832-1324-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2832-971-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2832-3342-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2848-109-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2848-2501-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2860-2823-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/2860-717-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2860-370-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB