Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/09/2024, 12:24

General

  • Target

    fc4a4d4caf18cc0aaf7bb85b2c1d5941_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    fc4a4d4caf18cc0aaf7bb85b2c1d5941

  • SHA1

    30048df1b00aea591547d804b33d3d3cecc3e057

  • SHA256

    7a213fcdde16cb13e022dbc3591c72d63de249bec4fabe9a68424dd79f875820

  • SHA512

    8567a12b2867b20e45d3df08ec6ca9369a4e1948ca16b0f51c4ac2aaf5a13c0db514205fd9e12aebe0b26f966f1a106173016123e39c5bc224e195cd95cb4a80

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZL:0UzeyQMS4DqodCnoe+iitjWwwP

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 46 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fc4a4d4caf18cc0aaf7bb85b2c1d5941_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fc4a4d4caf18cc0aaf7bb85b2c1d5941_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3960
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2804
      • C:\Users\Admin\AppData\Local\Temp\fc4a4d4caf18cc0aaf7bb85b2c1d5941_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\fc4a4d4caf18cc0aaf7bb85b2c1d5941_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2164
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:1700
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1568
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:1816
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:716
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1624
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:4356
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1980
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4640
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1308
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3604
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4040
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1100
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4924
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4828
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:208
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3776
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:2388
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:1540
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2904
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2440
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3660
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3952
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2704
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1180
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2272
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2868
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:3316
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:2424
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4544
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4880
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2888
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:320
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1460
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1916
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4920
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4228
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:4088
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                          PID:4864
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4872
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:5048
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:848
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4584
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4256
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:1300
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:3620
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:2636
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4964
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:2976
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:4376
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                          • System Location Discovery: System Language Discovery
                          PID:724
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:3972
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:2160
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:3768
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:5116
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:1920
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:4276
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:2404
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:4956
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Suspicious use of SetThreadContext
                        PID:2012
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                          • System Location Discovery: System Language Discovery
                          PID:3636
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:2604
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:2332
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:3680
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:2020
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:5080
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:2636
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:1372
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:2660
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:908
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                            PID:3020
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:4432
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:1260
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      PID:2532
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:1016
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          7⤵
                            PID:1828
                            • \??\c:\windows\system\explorer.exe
                              "c:\windows\system\explorer.exe"
                              8⤵
                                PID:2044
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:3056
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:4928
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:3988
                                • \??\c:\windows\system\explorer.exe
                                  "c:\windows\system\explorer.exe"
                                  8⤵
                                    PID:912
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              PID:2788
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:3764
                                • \??\c:\windows\system\explorer.exe
                                  c:\windows\system\explorer.exe
                                  7⤵
                                  • Drops file in Windows directory
                                  PID:3648
                                  • \??\c:\windows\system\explorer.exe
                                    "c:\windows\system\explorer.exe"
                                    8⤵
                                      PID:4940
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:5092
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4328
                                  • \??\c:\windows\system\explorer.exe
                                    c:\windows\system\explorer.exe
                                    7⤵
                                    • Drops file in Windows directory
                                    PID:5016
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                PID:1092
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3932
                                  • \??\c:\windows\system\explorer.exe
                                    c:\windows\system\explorer.exe
                                    7⤵
                                    • Drops file in Windows directory
                                    PID:1116
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:2672
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                    PID:1904
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      7⤵
                                        PID:3336
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    PID:4692
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                        PID:1012
                                        • \??\c:\windows\system\explorer.exe
                                          c:\windows\system\explorer.exe
                                          7⤵
                                          • Drops file in Windows directory
                                          PID:452
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:3672
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1812
                                        • \??\c:\windows\system\explorer.exe
                                          c:\windows\system\explorer.exe
                                          7⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3596
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      PID:1544
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                          PID:4548
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        PID:2236
                                        • \??\c:\windows\system\spoolsv.exe
                                          "c:\windows\system\spoolsv.exe"
                                          6⤵
                                            PID:4160
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1048
                                          • \??\c:\windows\system\spoolsv.exe
                                            "c:\windows\system\spoolsv.exe"
                                            6⤵
                                              PID:5060
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            PID:4308
                                            • \??\c:\windows\system\spoolsv.exe
                                              "c:\windows\system\spoolsv.exe"
                                              6⤵
                                                PID:1664
                                                • \??\c:\windows\system\explorer.exe
                                                  c:\windows\system\explorer.exe
                                                  7⤵
                                                    PID:4728
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                PID:796
                                                • \??\c:\windows\system\spoolsv.exe
                                                  "c:\windows\system\spoolsv.exe"
                                                  6⤵
                                                    PID:116
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                    PID:4148
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      "c:\windows\system\spoolsv.exe"
                                                      6⤵
                                                        PID:4860
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                        PID:2372
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          "c:\windows\system\spoolsv.exe"
                                                          6⤵
                                                            PID:2440
                                                            • \??\c:\windows\system\explorer.exe
                                                              c:\windows\system\explorer.exe
                                                              7⤵
                                                                PID:1660
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                            • Drops file in Windows directory
                                                            PID:2288
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              "c:\windows\system\spoolsv.exe"
                                                              6⤵
                                                                PID:2872
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Drops file in Windows directory
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4436
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Drops file in Windows directory
                                                              PID:3052
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Drops file in Windows directory
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1412
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Drops file in Windows directory
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2280
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Drops file in Windows directory
                                                              PID:3252
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Drops file in Windows directory
                                                              PID:2184
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Drops file in Windows directory
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5020
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Drops file in Windows directory
                                                              PID:3664
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Drops file in Windows directory
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1960
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1276
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                                PID:3920
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                5⤵
                                                                  PID:3832
                                                                • \??\c:\windows\system\spoolsv.exe
                                                                  c:\windows\system\spoolsv.exe SE
                                                                  5⤵
                                                                    PID:2108
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                                            1⤵
                                                              PID:5040

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Windows\Parameters.ini

                                                              Filesize

                                                              74B

                                                              MD5

                                                              6687785d6a31cdf9a5f80acb3abc459b

                                                              SHA1

                                                              1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                                              SHA256

                                                              3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                                              SHA512

                                                              5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                                            • C:\Windows\System\explorer.exe

                                                              Filesize

                                                              2.2MB

                                                              MD5

                                                              bf7fbe2af7a466bd0cb9eabd6117b053

                                                              SHA1

                                                              8c8ef67fdbe564e91d1fa3729aec62cdb885e63d

                                                              SHA256

                                                              fea5867d38d8be05648ecc0565a87696019121d8e50f235f0323da63ead815de

                                                              SHA512

                                                              994f477b54d97150a3d1c427937eb78b56fd87318501782d9cdfcd409cd1c490cc16a79bc9ac50c0d335d69fbc8fe2094f335e03efb237f209b3790873a97505

                                                            • \??\c:\windows\system\spoolsv.exe

                                                              Filesize

                                                              2.2MB

                                                              MD5

                                                              c36ab3fc82107daeb501684c18e14035

                                                              SHA1

                                                              a064df4ccd7237ade0f2e34def2731a71eaaab80

                                                              SHA256

                                                              34d16e988d59dcbbd2a483b5c7d61926e96ee4f3691a9d097aa864ee931214ae

                                                              SHA512

                                                              770673e234bf7d06b7e3b8b777de5a466cd683b252770de470a72176db9d12182de3ca369b71dd0ac28aa5802660769ebca3eb9b74e11317a66e5d2a6126db41

                                                            • memory/116-4936-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/116-4932-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/208-1136-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/320-2330-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/320-2326-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/716-1940-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/724-4474-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/848-1747-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/912-4945-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1012-4624-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1016-3391-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1100-1981-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1100-1985-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1180-2216-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1180-2219-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1300-2524-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1308-933-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1308-1975-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1460-1536-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1540-3779-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1568-682-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1568-96-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1568-4178-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1664-5095-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1664-4924-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1700-95-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1700-90-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1812-4906-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1816-1941-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1816-747-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1904-4517-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1904-4401-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1916-2408-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1920-1972-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1980-882-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1980-1964-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2020-2953-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2044-4844-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2160-2655-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2164-45-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2164-44-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2164-84-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2272-1292-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2332-2876-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2424-3914-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2440-2116-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2440-5115-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2636-2578-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2636-2582-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2636-2958-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2660-3058-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2704-1291-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2868-2306-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2888-1434-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2904-1192-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2976-2834-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2976-2648-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3020-4825-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3604-1973-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3620-1862-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/3636-4718-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3660-1243-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/3764-3716-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3768-1966-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/3776-2107-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3776-2248-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3932-4186-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3932-4306-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3952-2128-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3960-41-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/3960-0-0x00000000008D0000-0x00000000008D1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3960-49-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/3960-42-0x00000000008D0000-0x00000000008D1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3972-1959-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/4040-1004-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/4040-1983-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/4160-4836-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4228-2479-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4228-2624-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4256-1799-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/4276-2769-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4328-3903-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4328-4032-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4356-3553-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4544-1363-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/4548-4761-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4584-2500-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4640-1960-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4640-1961-0x0000000000440000-0x0000000000509000-memory.dmp

                                                              Filesize

                                                              804KB

                                                            • memory/4640-1963-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4828-1992-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4828-1997-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4860-5047-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4864-4248-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4872-1675-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/4880-2316-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4920-1603-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/4924-1070-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/4928-3678-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4940-5125-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4956-2868-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4964-1927-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/5048-2486-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/5048-2490-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/5060-4851-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB