Analysis

  • max time kernel
    137s
  • max time network
    52s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-06-2024 17:45

General

  • Target

    b356e0f18e36205d4a2c3f75b847092d_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    b356e0f18e36205d4a2c3f75b847092d

  • SHA1

    8f6fca9ec621725f760cd85487e949e172847823

  • SHA256

    6fa9876598a3beddb8091c6a41eba8d5b9b857f7fda992b5ed50cc76e2bb028a

  • SHA512

    49ac417babfe51c44e41915550ef3425c5046d78c3e8e5042ab5d78a438f4d00e21ca837fcc8125b0ddde6c9f18a1b1d5685a05d246d16798ea0f6ad9e72bd74

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZM:0UzeyQMS4DqodCnoe+iitjWwwY

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 45 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b356e0f18e36205d4a2c3f75b847092d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b356e0f18e36205d4a2c3f75b847092d_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:60
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1172
      • C:\Users\Admin\AppData\Local\Temp\b356e0f18e36205d4a2c3f75b847092d_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\b356e0f18e36205d4a2c3f75b847092d_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3056
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:3136
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2560
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:4432
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4820
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4376
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:3528
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4940
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4572
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:320
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4644
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3292
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3216
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4072
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:640
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2480
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1088
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:1968
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:2916
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:5096
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2620
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1592
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1816
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4636
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4500
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:4392
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                          PID:1800
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:1828
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:2648
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:2520
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1676
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:5108
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1304
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:2276
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:2236
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:848
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                            PID:4608
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:4268
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:3088
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:4916
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2616
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:3336
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1484
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:3832
                          • \??\c:\windows\system\explorer.exe
                            "c:\windows\system\explorer.exe"
                            8⤵
                              PID:4800
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:4204
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:4140
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:3228
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:4584
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:5088
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:64
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:3648
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:4716
                          • \??\c:\windows\system\explorer.exe
                            c:\windows\system\explorer.exe
                            7⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:3712
                            • \??\c:\windows\system\explorer.exe
                              "c:\windows\system\explorer.exe"
                              8⤵
                                PID:1948
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:872
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:4184
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:4536
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:3304
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:1804
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:1756
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:2800
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:3536
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              7⤵
                              • Suspicious use of SetThreadContext
                              • Drops file in Windows directory
                              PID:440
                              • \??\c:\windows\system\explorer.exe
                                "c:\windows\system\explorer.exe"
                                8⤵
                                  PID:3020
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:3384
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:1080
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:5012
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:4040
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:1600
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:4872
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:2312
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:2736
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Drops file in Windows directory
                                PID:448
                                • \??\c:\windows\system\explorer.exe
                                  "c:\windows\system\explorer.exe"
                                  8⤵
                                    PID:4928
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Drops file in Windows directory
                              PID:2440
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                • Suspicious use of SetWindowsHookEx
                                PID:4732
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Drops file in Windows directory
                              PID:4652
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                  PID:1556
                                  • \??\c:\windows\system\explorer.exe
                                    c:\windows\system\explorer.exe
                                    7⤵
                                    • Drops file in Windows directory
                                    PID:2316
                                    • \??\c:\windows\system\explorer.exe
                                      "c:\windows\system\explorer.exe"
                                      8⤵
                                        PID:2628
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  PID:4424
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                      PID:4196
                                      • \??\c:\windows\system\explorer.exe
                                        c:\windows\system\explorer.exe
                                        7⤵
                                        • Drops file in Windows directory
                                        PID:4044
                                        • \??\c:\windows\system\explorer.exe
                                          "c:\windows\system\explorer.exe"
                                          8⤵
                                            PID:3052
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      PID:4332
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                          PID:4120
                                          • \??\c:\windows\system\explorer.exe
                                            c:\windows\system\explorer.exe
                                            7⤵
                                            • Drops file in Windows directory
                                            PID:5024
                                            • \??\c:\windows\system\explorer.exe
                                              "c:\windows\system\explorer.exe"
                                              8⤵
                                                PID:1276
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          • Drops file in Windows directory
                                          PID:3116
                                          • \??\c:\windows\system\spoolsv.exe
                                            "c:\windows\system\spoolsv.exe"
                                            6⤵
                                              PID:2300
                                              • \??\c:\windows\system\explorer.exe
                                                c:\windows\system\explorer.exe
                                                7⤵
                                                • Drops file in Windows directory
                                                PID:3220
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            • Drops file in Windows directory
                                            PID:1668
                                            • \??\c:\windows\system\spoolsv.exe
                                              "c:\windows\system\spoolsv.exe"
                                              6⤵
                                                PID:1408
                                                • \??\c:\windows\system\explorer.exe
                                                  c:\windows\system\explorer.exe
                                                  7⤵
                                                  • Drops file in Windows directory
                                                  PID:1716
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:3868
                                              • \??\c:\windows\system\spoolsv.exe
                                                "c:\windows\system\spoolsv.exe"
                                                6⤵
                                                  PID:1372
                                                  • \??\c:\windows\system\explorer.exe
                                                    c:\windows\system\explorer.exe
                                                    7⤵
                                                    • Drops file in Windows directory
                                                    PID:3280
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Suspicious use of SetThreadContext
                                                PID:3164
                                                • \??\c:\windows\system\spoolsv.exe
                                                  "c:\windows\system\spoolsv.exe"
                                                  6⤵
                                                    PID:768
                                                    • \??\c:\windows\system\explorer.exe
                                                      c:\windows\system\explorer.exe
                                                      7⤵
                                                        PID:4948
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                      PID:3980
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        "c:\windows\system\spoolsv.exe"
                                                        6⤵
                                                          PID:3884
                                                          • \??\c:\windows\system\explorer.exe
                                                            c:\windows\system\explorer.exe
                                                            7⤵
                                                              PID:1176
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                            PID:1420
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              "c:\windows\system\spoolsv.exe"
                                                              6⤵
                                                                PID:820
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Drops file in Windows directory
                                                              PID:4492
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                "c:\windows\system\spoolsv.exe"
                                                                6⤵
                                                                  PID:2644
                                                                  • \??\c:\windows\system\explorer.exe
                                                                    c:\windows\system\explorer.exe
                                                                    7⤵
                                                                      PID:764
                                                                • \??\c:\windows\system\spoolsv.exe
                                                                  c:\windows\system\spoolsv.exe SE
                                                                  5⤵
                                                                  • Drops file in Windows directory
                                                                  PID:3520
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    "c:\windows\system\spoolsv.exe"
                                                                    6⤵
                                                                      PID:1280
                                                                      • \??\c:\windows\system\explorer.exe
                                                                        c:\windows\system\explorer.exe
                                                                        7⤵
                                                                          PID:1988
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                      • Drops file in Windows directory
                                                                      PID:1892
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        "c:\windows\system\spoolsv.exe"
                                                                        6⤵
                                                                          PID:852
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                        • Drops file in Windows directory
                                                                        PID:1400
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          "c:\windows\system\spoolsv.exe"
                                                                          6⤵
                                                                            PID:1368
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                          • Drops file in Windows directory
                                                                          PID:3480
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            "c:\windows\system\spoolsv.exe"
                                                                            6⤵
                                                                              PID:1752
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                            • Drops file in Windows directory
                                                                            PID:1232
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              "c:\windows\system\spoolsv.exe"
                                                                              6⤵
                                                                                PID:1700
                                                                                • \??\c:\windows\system\explorer.exe
                                                                                  c:\windows\system\explorer.exe
                                                                                  7⤵
                                                                                    PID:1140
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                • Drops file in Windows directory
                                                                                PID:3856
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  "c:\windows\system\spoolsv.exe"
                                                                                  6⤵
                                                                                    PID:1616
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                  • Drops file in Windows directory
                                                                                  PID:3344
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                  • Drops file in Windows directory
                                                                                  PID:1500
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                  • Drops file in Windows directory
                                                                                  PID:1456
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                  • Drops file in Windows directory
                                                                                  PID:720
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                  • Drops file in Windows directory
                                                                                  PID:672
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                  • Drops file in Windows directory
                                                                                  PID:4060
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                  • Drops file in Windows directory
                                                                                  PID:1808
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                    PID:3632
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    5⤵
                                                                                      PID:2932
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      5⤵
                                                                                        PID:1304
                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                        5⤵
                                                                                          PID:2448
                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                          5⤵
                                                                                            PID:1964
                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                            5⤵
                                                                                              PID:1980
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              5⤵
                                                                                                PID:3232
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                5⤵
                                                                                                  PID:3244
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                                                                          1⤵
                                                                                            PID:3328

                                                                                          Network

                                                                                          MITRE ATT&CK Enterprise v15

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          • C:\Windows\Parameters.ini

                                                                                            Filesize

                                                                                            74B

                                                                                            MD5

                                                                                            6687785d6a31cdf9a5f80acb3abc459b

                                                                                            SHA1

                                                                                            1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                                                                            SHA256

                                                                                            3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                                                                            SHA512

                                                                                            5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                                                                          • C:\Windows\System\explorer.exe

                                                                                            Filesize

                                                                                            2.2MB

                                                                                            MD5

                                                                                            9c9f07a1727c716017cf82b9c34da718

                                                                                            SHA1

                                                                                            adbbf8ab8dd31d90fbe7fa975710ed65f6de56aa

                                                                                            SHA256

                                                                                            8f3ea44fe6a802f8ffb8a368ed1808e74721d2cbaaa553c23a5fd05df5ef66f6

                                                                                            SHA512

                                                                                            41d691b07fa51ddd986bcd541951f84ae24d6fcaa76c24f79f5273518a16657a1cad9dc688d300bd03109cd1388d1792ade0881d48117418c35d63e229131739

                                                                                          • C:\Windows\System\spoolsv.exe

                                                                                            Filesize

                                                                                            2.2MB

                                                                                            MD5

                                                                                            4bb3ab60368baf32659143850425d4e8

                                                                                            SHA1

                                                                                            cb9b25e5708c929a826dd91618fb025826a22ba6

                                                                                            SHA256

                                                                                            cd19c1420ad93b45a87fce883e41ce13a6e38243bd52d2872867d51007181a89

                                                                                            SHA512

                                                                                            a2df9d494e8127951ccc4c453bcc2755c7c6c1d45fb0ccbb137a703bd64eca50726708d331f375a7bd8ec66002e893d3fa2a4d2ee80c6f426ff010fc3d98ebf6

                                                                                          • memory/60-31-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/60-33-0x0000000002470000-0x0000000002471000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/60-0-0x0000000002470000-0x0000000002471000-memory.dmp

                                                                                            Filesize

                                                                                            4KB

                                                                                          • memory/60-38-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/64-2757-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/320-2043-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/320-992-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/640-2065-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/640-2060-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/768-4802-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/768-4909-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/852-5265-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/872-2042-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/1080-3076-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1088-2161-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1088-2310-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1276-5501-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1280-5258-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1280-5413-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1304-2457-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1304-2454-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1368-5340-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1372-4726-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1372-4600-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1408-4324-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1484-2725-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1484-2872-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1556-3597-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1556-3719-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1592-1325-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/1616-5489-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1700-5482-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1752-5361-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1756-3000-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1756-3004-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1800-3964-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1816-2265-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/1828-1519-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/1948-4658-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/2236-2709-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/2236-2571-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/2276-1655-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/2300-4116-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/2300-4252-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/2480-1123-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/2520-1520-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/2560-79-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/2560-809-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/2616-2590-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/2620-2255-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/2628-5276-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/2644-5236-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/2644-5109-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/2648-2432-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/2736-3252-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/2736-3376-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/2916-3737-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/3052-5353-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/3056-37-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/3056-63-0x0000000000440000-0x0000000000509000-memory.dmp

                                                                                            Filesize

                                                                                            804KB

                                                                                          • memory/3056-36-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/3056-64-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/3088-2580-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/3136-75-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/3136-80-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/3216-2053-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/3228-2017-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/3292-2049-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/3292-993-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/3304-2917-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/3336-1863-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/3528-3522-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/3536-3066-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/3536-3235-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/3648-2029-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/3884-4925-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/3884-5028-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4040-3086-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4040-3081-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4072-1122-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/4120-3984-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4120-4097-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4140-2737-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4184-2907-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4184-2904-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4196-3748-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4204-1864-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/4268-1656-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/4432-2020-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/4432-810-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/4500-2500-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4500-2423-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4536-2051-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/4572-2030-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4584-2744-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4584-2749-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4608-4125-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4636-1326-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/4644-2040-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4716-3042-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4716-2896-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4732-3328-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4800-4353-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4820-2019-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4820-2098-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4872-3167-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4872-3163-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4916-1657-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/4928-4955-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                            Filesize

                                                                                            248KB

                                                                                          • memory/4940-991-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/4940-2031-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/5088-2018-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/5096-1324-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB

                                                                                          • memory/5108-1521-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                            Filesize

                                                                                            1.8MB