Analysis

  • max time kernel
    146s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    14-06-2024 08:48

General

  • Target

    a8ce89f645360a94d3f5047921950625_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    a8ce89f645360a94d3f5047921950625

  • SHA1

    6d7b7f1edfc7bf341b3c7830ad4cabf89170c76c

  • SHA256

    f10db93e25e680bc4e8a81a3ca8588b1b21ae42f9375ec037d7d832de0f38658

  • SHA512

    0b64e340845617b2437ccb6be975665b9089fcadb474b22de1edfbd46522e9a5b32a9a6acb8185f12061a9a08d31d058a407806af8da83074ffd89c1274c14cd

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZH:0UzeyQMS4DqodCnoe+iitjWwwL

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a8ce89f645360a94d3f5047921950625_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a8ce89f645360a94d3f5047921950625_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1900
      • C:\Users\Admin\AppData\Local\Temp\a8ce89f645360a94d3f5047921950625_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\a8ce89f645360a94d3f5047921950625_JaffaCakes118.exe"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2724
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2720
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2188
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              PID:2364
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                  PID:4712
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                      PID:4932
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  PID:1700
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                      PID:4732
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    PID:3052
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                        PID:4896
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      PID:2376
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                          PID:1240
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        PID:1696
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                            PID:5256
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              7⤵
                                PID:6440
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            PID:1000
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:6860
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              PID:2372
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              PID:2592
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                  PID:7084
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                PID:2720
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                    PID:7128
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:2792
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                      PID:5072
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    PID:1196
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Executes dropped EXE
                                    PID:712
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                        PID:7160
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:236
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1788
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2960
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                          PID:6040
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:2764
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:1012
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:1032
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:584
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:2344
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:940
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:1644
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:2436
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:2512
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:1904
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:1212
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:2180
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:2996
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:2992
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:2304
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:2500
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:1276
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:1796
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:808
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:2572
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:2716
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:316
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:2912
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:1956
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:1636
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:2604
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:1860
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:484
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:1804
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:2768
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:2648
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:2884
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:1712
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:2796
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:2600
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:1588
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:2380
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:2528
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:788
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:400
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:2744
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:328
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:2964
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:2456
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:2952
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        PID:2284
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:1008
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Drops file in Windows directory
                                        PID:2184
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                          PID:1440
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          PID:1776
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                            PID:2196
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                            • Drops file in Windows directory
                                            PID:1464
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                              PID:308
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                                PID:2232
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:904
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:2508
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                  PID:2896
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                    PID:3208
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                      PID:3348
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                      • Drops file in Windows directory
                                                      PID:3512
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                        PID:3672
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe SE
                                                        5⤵
                                                          PID:3828
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Drops file in Windows directory
                                                          PID:3988
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                            PID:1584
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                              PID:3204
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                                PID:3400
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                5⤵
                                                                • Drops file in Windows directory
                                                                PID:3588
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                5⤵
                                                                  PID:3764
                                                                • \??\c:\windows\system\spoolsv.exe
                                                                  c:\windows\system\spoolsv.exe SE
                                                                  5⤵
                                                                  • Drops file in Windows directory
                                                                  PID:3948
                                                                • \??\c:\windows\system\spoolsv.exe
                                                                  c:\windows\system\spoolsv.exe SE
                                                                  5⤵
                                                                    PID:2032
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe SE
                                                                    5⤵
                                                                      PID:3232
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                      • Drops file in Windows directory
                                                                      PID:3548
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                        PID:3708
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                          PID:3908
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                            PID:1864
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                              PID:3248
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe SE
                                                                              5⤵
                                                                              • Drops file in Windows directory
                                                                              PID:3468
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe SE
                                                                              5⤵
                                                                                PID:3664
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                  PID:3892
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                  • Drops file in Windows directory
                                                                                  PID:2444
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                  • Drops file in Windows directory
                                                                                  PID:3368
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                  • Drops file in Windows directory
                                                                                  PID:3560
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                    PID:3968
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    5⤵
                                                                                    • Drops file in Windows directory
                                                                                    PID:2104
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    5⤵
                                                                                      PID:3300
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      5⤵
                                                                                        PID:3604
                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                        5⤵
                                                                                          PID:3848
                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                          5⤵
                                                                                            PID:3080
                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                            5⤵
                                                                                              PID:3464
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              5⤵
                                                                                                PID:3724
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                5⤵
                                                                                                • Drops file in Windows directory
                                                                                                PID:4044
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                5⤵
                                                                                                  PID:3380
                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                  5⤵
                                                                                                  • Drops file in Windows directory
                                                                                                  PID:2620
                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                  5⤵
                                                                                                  • Drops file in Windows directory
                                                                                                  PID:2684
                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                  5⤵
                                                                                                    PID:3488
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                    5⤵
                                                                                                      PID:3884
                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                      5⤵
                                                                                                        PID:3284
                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                        5⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:3796
                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                        5⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:3152
                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                        5⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:3792
                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                        5⤵
                                                                                                          PID:3800
                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                          5⤵
                                                                                                            PID:4016
                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                            5⤵
                                                                                                            • Drops file in Windows directory
                                                                                                            PID:3644
                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                            5⤵
                                                                                                            • Drops file in Windows directory
                                                                                                            PID:3304
                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                            5⤵
                                                                                                              PID:3120
                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                              5⤵
                                                                                                              • Drops file in Windows directory
                                                                                                              PID:4084
                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                              5⤵
                                                                                                              • Drops file in Windows directory
                                                                                                              PID:4080
                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                              5⤵
                                                                                                                PID:3336
                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                5⤵
                                                                                                                  PID:3688
                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                  5⤵
                                                                                                                    PID:3256
                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                    5⤵
                                                                                                                      PID:3528
                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                      5⤵
                                                                                                                        PID:3220
                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                        5⤵
                                                                                                                          PID:4144
                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                          5⤵
                                                                                                                            PID:4300
                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                            5⤵
                                                                                                                              PID:4460
                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                              5⤵
                                                                                                                              • Drops file in Windows directory
                                                                                                                              PID:4620
                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                              5⤵
                                                                                                                              • Drops file in Windows directory
                                                                                                                              PID:4776
                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                              5⤵
                                                                                                                                PID:4936
                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                5⤵
                                                                                                                                  PID:5096
                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                  5⤵
                                                                                                                                    PID:4232
                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                    5⤵
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:4404
                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                    5⤵
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:4588
                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                    5⤵
                                                                                                                                      PID:4764
                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                      5⤵
                                                                                                                                        PID:4948
                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                        5⤵
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:4120
                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                        5⤵
                                                                                                                                          PID:4356
                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                          5⤵
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:4568
                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                          5⤵
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:4788
                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                          5⤵
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:4992
                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                          5⤵
                                                                                                                                            PID:4188
                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                            5⤵
                                                                                                                                              PID:4384
                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                              5⤵
                                                                                                                                                PID:4636
                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                5⤵
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:4876
                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                5⤵
                                                                                                                                                  PID:5104
                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                                  5⤵
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:4320
                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                                  5⤵
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:4652
                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                                  5⤵
                                                                                                                                                    PID:4868
                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                    5⤵
                                                                                                                                                      PID:3428
                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                        "c:\windows\system\spoolsv.exe"
                                                                                                                                                        6⤵
                                                                                                                                                          PID:5992
                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                        5⤵
                                                                                                                                                          PID:4416
                                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                                          5⤵
                                                                                                                                                            PID:5276
                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                            5⤵
                                                                                                                                                              PID:6628
                                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                                              5⤵
                                                                                                                                                                PID:7112

                                                                                                                                                      Network

                                                                                                                                                      MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                                                      Persistence

                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                      3
                                                                                                                                                      T1547

                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                      2
                                                                                                                                                      T1547.001

                                                                                                                                                      Winlogon Helper DLL

                                                                                                                                                      1
                                                                                                                                                      T1547.004

                                                                                                                                                      Privilege Escalation

                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                      3
                                                                                                                                                      T1547

                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                      2
                                                                                                                                                      T1547.001

                                                                                                                                                      Winlogon Helper DLL

                                                                                                                                                      1
                                                                                                                                                      T1547.004

                                                                                                                                                      Defense Evasion

                                                                                                                                                      Modify Registry

                                                                                                                                                      4
                                                                                                                                                      T1112

                                                                                                                                                      Hide Artifacts

                                                                                                                                                      1
                                                                                                                                                      T1564

                                                                                                                                                      Hidden Files and Directories

                                                                                                                                                      1
                                                                                                                                                      T1564.001

                                                                                                                                                      Discovery

                                                                                                                                                      System Information Discovery

                                                                                                                                                      1
                                                                                                                                                      T1082

                                                                                                                                                      Replay Monitor

                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                      Downloads

                                                                                                                                                      • C:\Windows\Parameters.ini
                                                                                                                                                        Filesize

                                                                                                                                                        74B

                                                                                                                                                        MD5

                                                                                                                                                        6687785d6a31cdf9a5f80acb3abc459b

                                                                                                                                                        SHA1

                                                                                                                                                        1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                                                                                                                                        SHA256

                                                                                                                                                        3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                                                                                                                                        SHA512

                                                                                                                                                        5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                                                                                                                                      • C:\Windows\Parameters.ini
                                                                                                                                                        MD5

                                                                                                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                        SHA1

                                                                                                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                        SHA256

                                                                                                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                        SHA512

                                                                                                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                      • \Windows\system\explorer.exe
                                                                                                                                                        Filesize

                                                                                                                                                        2.2MB

                                                                                                                                                        MD5

                                                                                                                                                        19031525b650851677beabbbd99397f1

                                                                                                                                                        SHA1

                                                                                                                                                        014b99d38a5b37d23d4bab1327afa2f12082e66c

                                                                                                                                                        SHA256

                                                                                                                                                        7653d3796383424f94c53bec54ad91d26f06c4ff3a4f2344141905ee761d5a7f

                                                                                                                                                        SHA512

                                                                                                                                                        15935563cd8a940c65089206aa3529d2bda01adc138b4e02be9cacbb95d0445d4eb41ceab4a9fd3c62c43218764c0c1fc882bafdc78fb461ccae95c4bfc397f1

                                                                                                                                                      • \Windows\system\spoolsv.exe
                                                                                                                                                        Filesize

                                                                                                                                                        2.2MB

                                                                                                                                                        MD5

                                                                                                                                                        45853b3c7e059cd1bee9b76ff9a54a09

                                                                                                                                                        SHA1

                                                                                                                                                        78c5895cddaf82be4fa1569d7aafa2cda78512fa

                                                                                                                                                        SHA256

                                                                                                                                                        7188e45613cbdd3fdb5f02101a13bc4a4df07f4d1a904473e9ff16920f723e64

                                                                                                                                                        SHA512

                                                                                                                                                        571e78fdb71ff31ced156b40741a5badbd2c357c1f68bf39f010c79ebcc193388985a7ead20ace9023a71f08cfd73b33cf08e17cbe915824d69867c306cd1851

                                                                                                                                                      • memory/236-3079-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/584-3090-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/712-3078-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/940-3485-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/1000-2567-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/1012-3088-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/1032-3089-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/1196-3077-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/1212-3495-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/1240-5571-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        248KB

                                                                                                                                                      • memory/1644-3486-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/1696-2566-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/1700-2563-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/1788-3080-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/1904-3494-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/1960-0-0x00000000001B0000-0x00000000001B1000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                      • memory/1960-29-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/1960-19-0x00000000001B0000-0x00000000001B1000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                      • memory/1960-17-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/2180-3496-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/2188-2561-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        248KB

                                                                                                                                                      • memory/2304-3499-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/2344-3484-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/2364-2562-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/2372-3073-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/2376-2565-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/2436-3487-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/2512-3488-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/2592-3074-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/2720-71-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/2720-61-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/2720-42-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/2720-3075-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/2724-28-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        248KB

                                                                                                                                                      • memory/2724-20-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        248KB

                                                                                                                                                      • memory/2724-27-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        248KB

                                                                                                                                                      • memory/2724-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        4KB

                                                                                                                                                      • memory/2724-50-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        248KB

                                                                                                                                                      • memory/2764-3082-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/2792-3076-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/2960-3081-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/2992-3498-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/2996-3497-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/3052-2564-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        1.8MB

                                                                                                                                                      • memory/4712-5502-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        248KB

                                                                                                                                                      • memory/4732-5513-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        248KB

                                                                                                                                                      • memory/4732-5518-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        248KB

                                                                                                                                                      • memory/5256-5651-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                                                                        Filesize

                                                                                                                                                        248KB