Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-06-2024 15:35

General

  • Target

    b441b4dc220214835fa5da98dd70cbd6_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    b441b4dc220214835fa5da98dd70cbd6

  • SHA1

    f0d39efb02b0c136f5dc18d8babb052a5e2cf1ec

  • SHA256

    5db94eb51c27f888b23b66451d4cdd6668cd6dad38088b672db07d1d67e70bcb

  • SHA512

    843100edb32b8dabe2c64ae92820d1317a6de1c21ccfba53dc30900243319ede9ce3492005bb5094c6dc499cc773f42fffaf058816e7634f9468e74730264565

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZB:0UzeyQMS4DqodCnoe+iitjWwwt

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 53 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b441b4dc220214835fa5da98dd70cbd6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b441b4dc220214835fa5da98dd70cbd6_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:4408
      • C:\Users\Admin\AppData\Local\Temp\b441b4dc220214835fa5da98dd70cbd6_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\b441b4dc220214835fa5da98dd70cbd6_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:876
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:1408
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4524
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:4984
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:868
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4680
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:8
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2412
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2488
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2880
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:732
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4488
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5088
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:5008
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1520
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4280
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:1836
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3972
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:5052
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1584
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3172
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4472
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4896
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:2036
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2148
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:4052
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                          PID:3592
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4028
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:440
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:3032
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4888
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4176
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:648
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:3228
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:3052
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:2688
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:2740
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4816
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:3680
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:2972
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                            PID:4092
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:3812
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:4648
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:3804
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2976
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:4140
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2644
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:3264
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1420
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:1348
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1976
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:2416
                          • \??\c:\windows\system\explorer.exe
                            "c:\windows\system\explorer.exe"
                            8⤵
                              PID:3292
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:1620
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1480
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:4468
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:2512
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:2380
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:660
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:3740
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:5116
                          • \??\c:\windows\system\explorer.exe
                            c:\windows\system\explorer.exe
                            7⤵
                            • Suspicious use of SetThreadContext
                            PID:3684
                            • \??\c:\windows\system\explorer.exe
                              "c:\windows\system\explorer.exe"
                              8⤵
                                PID:4968
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:3428
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:2792
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:4304
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:4032
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              7⤵
                              • Suspicious use of SetThreadContext
                              PID:3448
                              • \??\c:\windows\system\explorer.exe
                                "c:\windows\system\explorer.exe"
                                8⤵
                                  PID:3268
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:1980
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:3616
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:1572
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:5072
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:1556
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:1272
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:3640
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:456
                                • \??\c:\windows\system\explorer.exe
                                  c:\windows\system\explorer.exe
                                  7⤵
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  PID:4404
                                  • \??\c:\windows\system\explorer.exe
                                    "c:\windows\system\explorer.exe"
                                    8⤵
                                      PID:1832
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:3300
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                    PID:2640
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      7⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      PID:1724
                                      • \??\c:\windows\system\explorer.exe
                                        "c:\windows\system\explorer.exe"
                                        8⤵
                                          PID:2200
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • Drops file in Windows directory
                                    PID:3432
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                        PID:3164
                                        • \??\c:\windows\system\explorer.exe
                                          c:\windows\system\explorer.exe
                                          7⤵
                                          • Drops file in Windows directory
                                          PID:2076
                                          • \??\c:\windows\system\explorer.exe
                                            "c:\windows\system\explorer.exe"
                                            8⤵
                                              PID:2140
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • Drops file in Windows directory
                                        PID:1608
                                        • \??\c:\windows\system\spoolsv.exe
                                          "c:\windows\system\spoolsv.exe"
                                          6⤵
                                            PID:3752
                                            • \??\c:\windows\system\explorer.exe
                                              c:\windows\system\explorer.exe
                                              7⤵
                                              • Drops file in Windows directory
                                              PID:3532
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          • Drops file in Windows directory
                                          PID:1372
                                          • \??\c:\windows\system\spoolsv.exe
                                            "c:\windows\system\spoolsv.exe"
                                            6⤵
                                              PID:3040
                                              • \??\c:\windows\system\explorer.exe
                                                c:\windows\system\explorer.exe
                                                7⤵
                                                • Drops file in Windows directory
                                                PID:2888
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            PID:3932
                                            • \??\c:\windows\system\spoolsv.exe
                                              "c:\windows\system\spoolsv.exe"
                                              6⤵
                                                PID:1772
                                                • \??\c:\windows\system\explorer.exe
                                                  c:\windows\system\explorer.exe
                                                  7⤵
                                                  • Drops file in Windows directory
                                                  PID:4944
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Suspicious use of SetThreadContext
                                              • Drops file in Windows directory
                                              PID:2492
                                              • \??\c:\windows\system\spoolsv.exe
                                                "c:\windows\system\spoolsv.exe"
                                                6⤵
                                                  PID:2040
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Suspicious use of SetThreadContext
                                                • Drops file in Windows directory
                                                PID:1596
                                                • \??\c:\windows\system\spoolsv.exe
                                                  "c:\windows\system\spoolsv.exe"
                                                  6⤵
                                                    PID:2656
                                                    • \??\c:\windows\system\explorer.exe
                                                      c:\windows\system\explorer.exe
                                                      7⤵
                                                      • Drops file in Windows directory
                                                      PID:3472
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                  • Suspicious use of SetThreadContext
                                                  • Drops file in Windows directory
                                                  PID:3240
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    "c:\windows\system\spoolsv.exe"
                                                    6⤵
                                                      PID:4232
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                    • Suspicious use of SetThreadContext
                                                    • Drops file in Windows directory
                                                    PID:2904
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      "c:\windows\system\spoolsv.exe"
                                                      6⤵
                                                        PID:3560
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                      • Suspicious use of SetThreadContext
                                                      PID:4412
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        "c:\windows\system\spoolsv.exe"
                                                        6⤵
                                                          PID:1292
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe SE
                                                        5⤵
                                                        • Suspicious use of SetThreadContext
                                                        • Drops file in Windows directory
                                                        PID:2604
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          "c:\windows\system\spoolsv.exe"
                                                          6⤵
                                                            PID:3976
                                                            • \??\c:\windows\system\explorer.exe
                                                              c:\windows\system\explorer.exe
                                                              7⤵
                                                                PID:3792
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                            • Suspicious use of SetThreadContext
                                                            • Drops file in Windows directory
                                                            PID:1540
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              "c:\windows\system\spoolsv.exe"
                                                              6⤵
                                                                PID:5064
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Drops file in Windows directory
                                                              PID:4148
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                "c:\windows\system\spoolsv.exe"
                                                                6⤵
                                                                  PID:2496
                                                                  • \??\c:\windows\system\explorer.exe
                                                                    c:\windows\system\explorer.exe
                                                                    7⤵
                                                                      PID:736
                                                                • \??\c:\windows\system\spoolsv.exe
                                                                  c:\windows\system\spoolsv.exe SE
                                                                  5⤵
                                                                  • Drops file in Windows directory
                                                                  PID:3780
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    "c:\windows\system\spoolsv.exe"
                                                                    6⤵
                                                                      PID:4108
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe SE
                                                                    5⤵
                                                                    • Drops file in Windows directory
                                                                    PID:3756
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      "c:\windows\system\spoolsv.exe"
                                                                      6⤵
                                                                        PID:3544
                                                                        • \??\c:\windows\system\explorer.exe
                                                                          c:\windows\system\explorer.exe
                                                                          7⤵
                                                                            PID:1964
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                        • Drops file in Windows directory
                                                                        PID:4804
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          "c:\windows\system\spoolsv.exe"
                                                                          6⤵
                                                                            PID:744
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                          • Drops file in Windows directory
                                                                          PID:3708
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                          • Drops file in Windows directory
                                                                          PID:4168
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                          • Drops file in Windows directory
                                                                          PID:4184
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                            PID:700
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                            • Drops file in Windows directory
                                                                            PID:1396
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                            • Drops file in Windows directory
                                                                            PID:2796
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                              PID:880
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe SE
                                                                              5⤵
                                                                                PID:4668
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                • Drops file in Windows directory
                                                                                PID:3572
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                  PID:404
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                    PID:4676
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    5⤵
                                                                                      PID:464
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      5⤵
                                                                                        PID:536
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                                                                1⤵
                                                                                  PID:2952

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v15

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • C:\Windows\Parameters.ini

                                                                                  Filesize

                                                                                  74B

                                                                                  MD5

                                                                                  6687785d6a31cdf9a5f80acb3abc459b

                                                                                  SHA1

                                                                                  1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                                                                  SHA256

                                                                                  3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                                                                  SHA512

                                                                                  5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                                                                • C:\Windows\System\explorer.exe

                                                                                  Filesize

                                                                                  2.2MB

                                                                                  MD5

                                                                                  de4a896229f3b0931a8e8c2003e0bfed

                                                                                  SHA1

                                                                                  911d2b25dac8a7daeca29c21b41dcdc2220a7291

                                                                                  SHA256

                                                                                  6acee230c2a871933e57478e2d464b3b05a094cacaf660d58094495c79c84a1c

                                                                                  SHA512

                                                                                  fbb8eb28324aac3b33753b611b8ec23f1780ba6c8cb43c79df0b7f476a561039c5b710566cb858301a9653dae2e3f8f50b5f1a453f551e60d5c9800222c3152f

                                                                                • C:\Windows\System\spoolsv.exe

                                                                                  Filesize

                                                                                  2.2MB

                                                                                  MD5

                                                                                  e1578932bfb63752717fe3118788b079

                                                                                  SHA1

                                                                                  89aa6a26ac4c17def73c559cc2bc7dd5c23f0cf2

                                                                                  SHA256

                                                                                  464534ccf888c70b8dc173032e1184a4c4d4aef94f046920b8c1d3355a3711b1

                                                                                  SHA512

                                                                                  30b2aee57c40a263dc91e0a1c473270bfd888dc3cf5ca867f4dfa2563d9fe3f1ffede926b36f3c6bc0b0b832567b3259154d3ff17e826863707309af9a3505c4

                                                                                • memory/8-3437-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/440-2314-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/440-2319-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/456-3345-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/456-3277-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/648-2416-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/660-2849-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/732-2061-0x0000000000440000-0x0000000000509000-memory.dmp

                                                                                  Filesize

                                                                                  804KB

                                                                                • memory/732-2065-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/744-5343-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/744-5340-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/868-2136-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/868-1978-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/876-46-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/876-44-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/876-93-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/1272-3196-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/1292-4923-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/1348-1977-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/1408-104-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/1408-99-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/1420-2669-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/1480-2754-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/1520-2288-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/1520-2169-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/1584-1155-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/1596-41-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/1596-47-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/1596-43-0x0000000002380000-0x0000000002381000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1596-0-0x0000000002380000-0x0000000002381000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                • memory/1620-2052-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/1772-4597-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/1772-4433-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/1832-4806-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/1836-3661-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/1976-2919-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/1976-2745-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/2036-1347-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/2040-4535-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/2140-5332-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/2148-2480-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/2148-2306-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/2200-4988-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/2380-2075-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/2412-960-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/2412-2054-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/2488-2053-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/2496-5144-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/2512-2763-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/2512-2768-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/2640-3491-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/2640-3619-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/2656-4948-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/2656-4767-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/2688-1692-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/2740-2452-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/2792-2944-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/2880-961-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/2880-2067-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/2976-2578-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/3032-1486-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/3040-4213-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/3052-2428-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/3052-2432-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/3164-3895-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/3164-3781-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/3172-2239-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/3228-1691-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/3264-1976-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/3268-4775-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/3292-4440-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/3292-4443-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/3544-5322-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/3592-3994-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/3616-3113-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/3680-2557-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/3752-4078-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/3804-1888-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/3812-1887-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/3972-1154-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/3976-5116-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/3976-4969-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/4028-1348-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/4032-3108-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/4032-3194-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/4108-5236-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/4140-1889-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/4176-1487-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/4232-4785-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/4468-2064-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/4472-1346-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/4488-962-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/4524-833-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/4524-103-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/4648-2564-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/4648-2568-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/4816-1693-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/4888-2330-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/4896-2259-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/4968-4545-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/4984-1979-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/4984-839-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/5008-1153-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                  Filesize

                                                                                  1.8MB

                                                                                • memory/5052-2178-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/5088-2076-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/5116-2936-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB

                                                                                • memory/5116-3089-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                  Filesize

                                                                                  248KB