Analysis

  • max time kernel
    147s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-06-2024 09:31

General

  • Target

    a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    a8fa3c57ab33dd66ba742d49a0e9cd7b

  • SHA1

    1ac207291937059c22d65b3264460ffec694debd

  • SHA256

    d8ea3aa3bda006bb7ead336e77a992f59b9fdb81466a4f1eda0c2958c277615f

  • SHA512

    3d8450cea05047c9eb1e7eccc5104134d33caf8141f50874a2b5d42f5e5404ed3fdfd83c1c71ded0e818eee75bc47b26db6b670b5c9c028a42ba0274243c70ff

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZg:0UzeyQMS4DqodCnoe+iitjWwwE

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 57 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2508
      • C:\Users\Admin\AppData\Local\Temp\a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\a8fa3c57ab33dd66ba742d49a0e9cd7b_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2540
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4260
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1632
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:1444
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:5296
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:5348
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:6060
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:832
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5388
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2288
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5488
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4948
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5564
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:4368
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5636
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:2996
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5700
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2816
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5772
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1796
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5840
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3000
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:644
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:5172
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:440
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4156
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:5552
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:5064
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4760
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1884
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4568
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4140
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:5704
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:3160
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:5804
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:3436
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:5832
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1168
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:6052
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:2356
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3444
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1032
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:5540
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:796
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                          PID:3936
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:3924
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:5556
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:3496
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:5644
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:3504
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:5560
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:5092
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:5908
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:2700
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:6076
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:2348
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                            PID:4196
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:932
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:1956
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:2824
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:224
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:1412
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:5276
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:3384
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:1128
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:1912
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:348
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:3036
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:1036
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          7⤵
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:3164
                          • \??\c:\windows\system\explorer.exe
                            "c:\windows\system\explorer.exe"
                            8⤵
                              PID:3084
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:4112
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                            PID:5872
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:2236
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:1000
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:2464
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:6104
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Drops file in Windows directory
                              PID:340
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                  PID:6092
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                PID:2420
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                    PID:3612
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      7⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      PID:4088
                                      • \??\c:\windows\system\explorer.exe
                                        "c:\windows\system\explorer.exe"
                                        8⤵
                                          PID:4764
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:5212
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                        PID:5496
                                        • \??\c:\windows\system\explorer.exe
                                          c:\windows\system\explorer.exe
                                          7⤵
                                          • Suspicious use of SetThreadContext
                                          PID:2436
                                          • \??\c:\windows\system\explorer.exe
                                            "c:\windows\system\explorer.exe"
                                            8⤵
                                              PID:3440
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • Drops file in Windows directory
                                        PID:5512
                                        • \??\c:\windows\system\spoolsv.exe
                                          "c:\windows\system\spoolsv.exe"
                                          6⤵
                                            PID:5400
                                            • \??\c:\windows\system\explorer.exe
                                              c:\windows\system\explorer.exe
                                              7⤵
                                              • Drops file in Windows directory
                                              PID:3428
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          • Drops file in Windows directory
                                          PID:6084
                                          • \??\c:\windows\system\spoolsv.exe
                                            "c:\windows\system\spoolsv.exe"
                                            6⤵
                                              PID:3672
                                              • \??\c:\windows\system\explorer.exe
                                                c:\windows\system\explorer.exe
                                                7⤵
                                                • Drops file in Windows directory
                                                PID:4560
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            • Drops file in Windows directory
                                            PID:5784
                                            • \??\c:\windows\system\spoolsv.exe
                                              "c:\windows\system\spoolsv.exe"
                                              6⤵
                                                PID:5656
                                                • \??\c:\windows\system\explorer.exe
                                                  c:\windows\system\explorer.exe
                                                  7⤵
                                                  • Drops file in Windows directory
                                                  PID:5152
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Suspicious use of SetThreadContext
                                              PID:1644
                                              • \??\c:\windows\system\spoolsv.exe
                                                "c:\windows\system\spoolsv.exe"
                                                6⤵
                                                  PID:5420
                                                  • \??\c:\windows\system\explorer.exe
                                                    c:\windows\system\explorer.exe
                                                    7⤵
                                                      PID:4724
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                  • Suspicious use of SetThreadContext
                                                  • Drops file in Windows directory
                                                  PID:1384
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    "c:\windows\system\spoolsv.exe"
                                                    6⤵
                                                      PID:4404
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                    • Suspicious use of SetThreadContext
                                                    • Drops file in Windows directory
                                                    PID:5800
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      "c:\windows\system\spoolsv.exe"
                                                      6⤵
                                                        PID:6088
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                      • Suspicious use of SetThreadContext
                                                      • Drops file in Windows directory
                                                      PID:4836
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        "c:\windows\system\spoolsv.exe"
                                                        6⤵
                                                          PID:4348
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe SE
                                                        5⤵
                                                        • Suspicious use of SetThreadContext
                                                        • Drops file in Windows directory
                                                        PID:5608
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          "c:\windows\system\spoolsv.exe"
                                                          6⤵
                                                            PID:4084
                                                            • \??\c:\windows\system\explorer.exe
                                                              c:\windows\system\explorer.exe
                                                              7⤵
                                                              • Drops file in Windows directory
                                                              PID:5404
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Suspicious use of SetThreadContext
                                                          PID:1800
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            "c:\windows\system\spoolsv.exe"
                                                            6⤵
                                                              PID:332
                                                              • \??\c:\windows\system\explorer.exe
                                                                c:\windows\system\explorer.exe
                                                                7⤵
                                                                • Drops file in Windows directory
                                                                PID:4552
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                            • Suspicious use of SetThreadContext
                                                            • Drops file in Windows directory
                                                            PID:5572
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              "c:\windows\system\spoolsv.exe"
                                                              6⤵
                                                                PID:5736
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Suspicious use of SetThreadContext
                                                              • Drops file in Windows directory
                                                              PID:5260
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                "c:\windows\system\spoolsv.exe"
                                                                6⤵
                                                                  PID:1620
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                5⤵
                                                                • Suspicious use of SetThreadContext
                                                                • Drops file in Windows directory
                                                                PID:3196
                                                                • \??\c:\windows\system\spoolsv.exe
                                                                  "c:\windows\system\spoolsv.exe"
                                                                  6⤵
                                                                    PID:2612
                                                                • \??\c:\windows\system\spoolsv.exe
                                                                  c:\windows\system\spoolsv.exe SE
                                                                  5⤵
                                                                  • Suspicious use of SetThreadContext
                                                                  • Drops file in Windows directory
                                                                  PID:3540
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    "c:\windows\system\spoolsv.exe"
                                                                    6⤵
                                                                      PID:4692
                                                                      • \??\c:\windows\system\explorer.exe
                                                                        c:\windows\system\explorer.exe
                                                                        7⤵
                                                                          PID:5968
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                      • Drops file in Windows directory
                                                                      PID:1996
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        "c:\windows\system\spoolsv.exe"
                                                                        6⤵
                                                                          PID:908
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                        • Drops file in Windows directory
                                                                        PID:2548
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          "c:\windows\system\spoolsv.exe"
                                                                          6⤵
                                                                            PID:5012
                                                                            • \??\c:\windows\system\explorer.exe
                                                                              c:\windows\system\explorer.exe
                                                                              7⤵
                                                                                PID:2536
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                              PID:1948
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe SE
                                                                              5⤵
                                                                                PID:2460
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                • Drops file in Windows directory
                                                                                PID:5424
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                • Drops file in Windows directory
                                                                                PID:2008
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                • Drops file in Windows directory
                                                                                PID:2684
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                • Drops file in Windows directory
                                                                                PID:5444
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                • Drops file in Windows directory
                                                                                PID:5072
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                • Drops file in Windows directory
                                                                                PID:2992
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                • Drops file in Windows directory
                                                                                PID:5508
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                • Drops file in Windows directory
                                                                                PID:1616
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                • Drops file in Windows directory
                                                                                PID:5816
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                  PID:1568
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                  • Drops file in Windows directory
                                                                                  PID:972
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                  • Drops file in Windows directory
                                                                                  PID:5208
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                  • Drops file in Windows directory
                                                                                  PID:1992
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                    PID:5972
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    5⤵
                                                                                      PID:5696
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      5⤵
                                                                                        PID:5748
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                                                                1⤵
                                                                                  PID:1936
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4628,i,1400471177590024469,587385956640537806,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
                                                                                  1⤵
                                                                                    PID:1048

                                                                                  Network

                                                                                  MITRE ATT&CK Matrix ATT&CK v13

                                                                                  Persistence

                                                                                  Boot or Logon Autostart Execution

                                                                                  3
                                                                                  T1547

                                                                                  Registry Run Keys / Startup Folder

                                                                                  2
                                                                                  T1547.001

                                                                                  Winlogon Helper DLL

                                                                                  1
                                                                                  T1547.004

                                                                                  Privilege Escalation

                                                                                  Boot or Logon Autostart Execution

                                                                                  3
                                                                                  T1547

                                                                                  Registry Run Keys / Startup Folder

                                                                                  2
                                                                                  T1547.001

                                                                                  Winlogon Helper DLL

                                                                                  1
                                                                                  T1547.004

                                                                                  Defense Evasion

                                                                                  Modify Registry

                                                                                  4
                                                                                  T1112

                                                                                  Hide Artifacts

                                                                                  1
                                                                                  T1564

                                                                                  Hidden Files and Directories

                                                                                  1
                                                                                  T1564.001

                                                                                  Discovery

                                                                                  System Information Discovery

                                                                                  1
                                                                                  T1082

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  • C:\Windows\Parameters.ini
                                                                                    Filesize

                                                                                    74B

                                                                                    MD5

                                                                                    6687785d6a31cdf9a5f80acb3abc459b

                                                                                    SHA1

                                                                                    1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                                                                    SHA256

                                                                                    3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                                                                    SHA512

                                                                                    5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                                                                  • C:\Windows\System\explorer.exe
                                                                                    Filesize

                                                                                    2.2MB

                                                                                    MD5

                                                                                    31b8a20a1dc79f45ab7fc95f7adf972b

                                                                                    SHA1

                                                                                    ee7deeb687d40f2685cd51306737062f8afaee18

                                                                                    SHA256

                                                                                    12a4fc7bf575e5c6adda5c8c668493e84f63faf98fe35b84ac2ca50e84355a80

                                                                                    SHA512

                                                                                    bb687738d946bf799e939c6112a3b33a844fa501cb58fa47274b50f4858654c65afe02534e6b791998cf760b207c4e30eca7f3cdd8d3d2404519e4e08f28757c

                                                                                  • C:\Windows\System\spoolsv.exe
                                                                                    Filesize

                                                                                    2.2MB

                                                                                    MD5

                                                                                    6427a6bdbfd56d00d1390917dc17eeee

                                                                                    SHA1

                                                                                    df1a765ba5dc7f3b420780deb2b9b7ce9b3d56d9

                                                                                    SHA256

                                                                                    939178932e22a481cf7147c103c03387b8423744d0ada8c3c346df5eb9105702

                                                                                    SHA512

                                                                                    c4ea44dcc3de46827764a378985016e26caff073645c001eec1196596aba1c58e9a36e75052a7f3a2aa4665c3d20b85f506db66f4e03d53ea96d4c9658863e96

                                                                                  • memory/224-3024-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/332-5465-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/348-3130-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/440-4257-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/644-2824-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/644-2524-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/832-2363-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/832-1211-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/908-5781-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/908-5778-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/932-2361-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/1000-3220-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/1032-2042-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/1036-3362-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/1036-3202-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/1168-2040-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/1444-1005-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/1444-2355-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/1620-5559-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/1620-5562-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/1632-999-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/1632-84-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/1796-1387-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/1884-26-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/1884-28-0x00000000008D0000-0x00000000008D1000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/1884-32-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/1884-0-0x00000000008D0000-0x00000000008D1000-memory.dmp
                                                                                    Filesize

                                                                                    4KB

                                                                                  • memory/1884-1828-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/2288-2377-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/2288-1212-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/2356-2041-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/2540-67-0x0000000000440000-0x0000000000509000-memory.dmp
                                                                                    Filesize

                                                                                    804KB

                                                                                  • memory/2540-31-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/2540-29-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/2540-68-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/2700-2353-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/2816-1386-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/2824-2373-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/2996-1385-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/3000-1598-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/3084-5132-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/3160-1830-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/3436-2039-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/3440-5582-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/3496-2238-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/3504-2239-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/3612-3524-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/3672-4527-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/3924-2237-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/3936-4536-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/4084-5438-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/4140-1829-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/4156-1599-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/4196-4924-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/4260-79-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/4260-85-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/4368-1384-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/4568-2629-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/4692-5708-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/4692-5809-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/4760-2619-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/4948-1213-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/5012-5907-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5064-1600-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/5092-2352-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                    Filesize

                                                                                    1.8MB

                                                                                  • memory/5296-2354-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5296-2505-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5388-2362-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5388-2366-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5400-4309-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5400-4189-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5420-5123-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5420-5258-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5488-2379-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5488-2374-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5496-3936-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5540-2989-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5540-2842-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5552-2606-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5552-2611-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5556-2850-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5560-2869-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5564-2387-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5636-2398-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5644-2860-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5656-4855-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5656-4986-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5700-2409-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5704-2640-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5704-2644-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5736-5549-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5772-2419-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5804-2656-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5840-2445-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5872-3209-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/5908-2948-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/6052-2741-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/6060-3798-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/6076-3184-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/6076-3007-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/6092-3237-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB

                                                                                  • memory/6104-3230-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB