Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    114s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2024, 11:45

General

  • Target

    19149b26fea77aa31d116c7373347451efd98857417d31b94ac93179aa7bb911N.exe

  • Size

    8.9MB

  • MD5

    021b990c95a7c5943e726e8b7566d030

  • SHA1

    8a6705674ceba5cbe1c1498c274d80adcbd11e3d

  • SHA256

    19149b26fea77aa31d116c7373347451efd98857417d31b94ac93179aa7bb911

  • SHA512

    79e5ae3e76d85c688a91d92a08974fdd47ae89de70e1baa4de03c85f550cd608386cdf8ebb35a516299365e082b58cd66ffc49de8ebcf9c3ad72a660356236d5

  • SSDEEP

    49152:K1XP6rPbNechC0bNechC0bNecIC0bNechC0bNechC0bNeco:K1+8e8e8f8e8e8h

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzonerat family
  • Warzone RAT payload 3 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\19149b26fea77aa31d116c7373347451efd98857417d31b94ac93179aa7bb911N.exe
    "C:\Users\Admin\AppData\Local\Temp\19149b26fea77aa31d116c7373347451efd98857417d31b94ac93179aa7bb911N.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:644
    • C:\Users\Admin\AppData\Local\Temp\19149b26fea77aa31d116c7373347451efd98857417d31b94ac93179aa7bb911N.exe
      "C:\Users\Admin\AppData\Local\Temp\19149b26fea77aa31d116c7373347451efd98857417d31b94ac93179aa7bb911N.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3520
      • \??\c:\windows\system\explorer.exe
        c:\windows\system\explorer.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1948
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3524
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:3544
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:1592
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3836
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2512
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:4056
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:3960
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:224
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4484
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5104
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:1352
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1696
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2832
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4656
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1872
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2740
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2760
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:5016
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4904
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:756
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:4880
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3392
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:3876
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:1084
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:4284
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:760
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5064
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:232
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2004
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:1212
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2352
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4376
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4528
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:4368
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2796
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2396
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2160
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:3656
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1680
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1544
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:456
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:3932
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2284
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4312
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2992
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:3964
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2524
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:1964
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4824
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2164
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:3884
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:1596
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:468
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1760
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4260
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5060
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3248
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:3536
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:4496
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:3352
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:4640
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:3496
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:1452
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
              PID:1744
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
                PID:2508
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                  PID:4644
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:3104
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                    PID:640
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                      PID:1636
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:1880
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:1748
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:2116
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                        PID:4004
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                          PID:32
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                            PID:3880
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:4212
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:4428
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:2840
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:5116
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:4596
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                              PID:2680
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:4812
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:3488
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                                PID:1380
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:1348
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:2540
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                  PID:4612
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                    PID:2440
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1756
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2948
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3092
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                      PID:2756
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2732
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                        PID:3556
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2504
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3640
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3936
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:832
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1948
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2816
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1248
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:332
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                          PID:436
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:5072
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                            PID:4508
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                              PID:2128
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:556
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3076
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                                PID:3384
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:5128
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                  PID:5144
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                    PID:5160
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5176
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5192
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5208
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                      PID:5224
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5240
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                        PID:5256
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe SE
                                                        5⤵
                                                          PID:5284
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                            PID:5304
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                              PID:5320
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5336
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5352
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5372
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                                PID:5388
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                5⤵
                                                                  PID:5404
                                                                • \??\c:\windows\system\spoolsv.exe
                                                                  c:\windows\system\spoolsv.exe SE
                                                                  5⤵
                                                                    PID:5424
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe SE
                                                                    5⤵
                                                                      PID:5448
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                        PID:5464
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                          PID:5480
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                            PID:5500
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                              PID:5520
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe SE
                                                                              5⤵
                                                                                PID:6108
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                  PID:6124
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                    PID:5124
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    5⤵
                                                                                      PID:5280
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      5⤵
                                                                                        PID:5444
                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                        5⤵
                                                                                          PID:6156
                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                          5⤵
                                                                                            PID:6172
                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                            5⤵
                                                                                              PID:6188
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              5⤵
                                                                                                PID:6208
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                5⤵
                                                                                                  PID:6224
                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                  5⤵
                                                                                                    PID:6248
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                    5⤵
                                                                                                      PID:6272
                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                      5⤵
                                                                                                        PID:6288
                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                        5⤵
                                                                                                          PID:6336
                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                          5⤵
                                                                                                            PID:6356
                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                            5⤵
                                                                                                              PID:6384
                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                              5⤵
                                                                                                                PID:6412
                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                5⤵
                                                                                                                  PID:6444
                                                                                                              • C:\Windows\SysWOW64\diskperf.exe
                                                                                                                "C:\Windows\SysWOW64\diskperf.exe"
                                                                                                                4⤵
                                                                                                                  PID:1184
                                                                                                            • C:\Windows\SysWOW64\diskperf.exe
                                                                                                              "C:\Windows\SysWOW64\diskperf.exe"
                                                                                                              2⤵
                                                                                                                PID:3324

                                                                                                            Network

                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            • C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

                                                                                                              Filesize

                                                                                                              8.9MB

                                                                                                              MD5

                                                                                                              021b990c95a7c5943e726e8b7566d030

                                                                                                              SHA1

                                                                                                              8a6705674ceba5cbe1c1498c274d80adcbd11e3d

                                                                                                              SHA256

                                                                                                              19149b26fea77aa31d116c7373347451efd98857417d31b94ac93179aa7bb911

                                                                                                              SHA512

                                                                                                              79e5ae3e76d85c688a91d92a08974fdd47ae89de70e1baa4de03c85f550cd608386cdf8ebb35a516299365e082b58cd66ffc49de8ebcf9c3ad72a660356236d5

                                                                                                            • C:\Windows\System\explorer.exe

                                                                                                              Filesize

                                                                                                              8.9MB

                                                                                                              MD5

                                                                                                              e29018ee76c7039819ba82f4990c0443

                                                                                                              SHA1

                                                                                                              c99916570627fc6ef0d53560d47fa557b0383733

                                                                                                              SHA256

                                                                                                              93dd57c5ea9d0b429eaface00cbd3a03956a28e985e441b586e9a2b5269c52ee

                                                                                                              SHA512

                                                                                                              0cb77c50c6437e61de8f62e084ae069fc0ed04d4688da8b001f8a403f1ed8ac3b0cb77fc73199d85dc50f695f24d9d6588a8e3c496ab3c1df28802c14542d1a7

                                                                                                            • C:\Windows\System\spoolsv.exe

                                                                                                              Filesize

                                                                                                              8.9MB

                                                                                                              MD5

                                                                                                              5b0a5436984f68860dcb19c5dda4fb9d

                                                                                                              SHA1

                                                                                                              00d99a3d24156467cd268beec49122ffe78ae3b1

                                                                                                              SHA256

                                                                                                              1cb2e3b08611d01f9d88c7901398c9839e18b969af39d95a97b6c499a2eb02d0

                                                                                                              SHA512

                                                                                                              562f40947a4c036b8e2e1a2be0005da9da5fac7afed576f5ab552b5560f1890e34b527453d927eabf744f0f237aa19201706d336e4309ab87adfb93d3b667458

                                                                                                            • memory/32-192-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/224-79-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/232-120-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/456-146-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/468-166-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/640-185-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/644-15-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/644-0-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/644-3-0x0000000000B30000-0x0000000000B31000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/644-2-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/644-1-0x0000000000B30000-0x0000000000B31000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/756-103-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/760-116-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1084-112-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1184-42-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                            • memory/1212-124-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1352-85-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1452-167-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1452-180-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1544-144-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1592-68-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1596-165-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1636-186-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1680-142-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1696-66-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1696-87-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1744-181-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1748-188-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1760-168-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1872-93-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1880-187-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1880-177-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1948-23-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1948-27-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1948-45-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/1964-160-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/2004-122-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/2116-189-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/2160-138-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/2164-163-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/2284-150-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/2352-126-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/2396-136-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/2508-182-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/2512-73-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/2524-158-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/2740-95-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/2760-97-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/2796-134-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/2832-89-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/2992-154-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/3104-173-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/3104-184-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/3248-172-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/3324-13-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                            • memory/3324-12-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                            • memory/3324-8-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                            • memory/3352-176-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/3392-108-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/3496-179-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/3520-9-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                              Filesize

                                                                                                              248KB

                                                                                                            • memory/3520-26-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                              Filesize

                                                                                                              248KB

                                                                                                            • memory/3520-4-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                              Filesize

                                                                                                              248KB

                                                                                                            • memory/3524-36-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                              Filesize

                                                                                                              248KB

                                                                                                            • memory/3524-59-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                              Filesize

                                                                                                              248KB

                                                                                                            • memory/3536-174-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/3544-65-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/3656-140-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/3836-70-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/3876-110-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/3880-193-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/3884-164-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/3932-148-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/3960-77-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/3964-156-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4004-191-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4056-75-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4212-194-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4260-170-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4284-114-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4312-152-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4368-132-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4376-128-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4428-195-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4484-61-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4484-81-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4496-175-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4528-130-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4640-178-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4644-183-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4656-71-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4656-91-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4812-190-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4824-162-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4880-105-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/4904-101-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/5016-99-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/5060-171-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/5064-118-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/5104-83-0x0000000000400000-0x0000000000515000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB