Analysis

  • max time kernel
    80s
  • max time network
    104s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250502-en
  • resource tags

    arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    23/05/2025, 15:33

General

  • Target

    JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe

  • Size

    2.2MB

  • MD5

    080d2a293751e6d785a73a11664845d0

  • SHA1

    5f84d3fa42600199117b4713fea7a6f200e6da31

  • SHA256

    eb83ad2266873e7f557a2b3d521a1593ec21a59bb05e8f3bcc240901a6a5f8db

  • SHA512

    d7095e4e46b1c12b16fb1a496f36f82ac9764456f858d06e4dec2a7a486445a102354bb2fc98a05f94721cd520cfb9766846e66ab276abe76c38687f5c430ea0

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZB:0UzeyQMS4DqodCnoe+iitjWwwl

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Detects Mofksys worm 59 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Mofksys

    Mofksys is a worm written in VisualBasic.

  • Mofksys family
  • Pony family
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 25 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:3268
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_080d2a293751e6d785a73a11664845d0.exe"
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4764
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3132
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3508
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3100
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                  PID:5780
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                      PID:3080
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                          PID:3492
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:1208
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                        PID:1392
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:3748
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                          PID:5416
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:964
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                            PID:2508
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:5748
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:5504
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:4988
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:2008
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:1204
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                  PID:5056
                                  • \??\c:\windows\system\explorer.exe
                                    c:\windows\system\explorer.exe
                                    7⤵
                                      PID:3384
                                      • \??\c:\windows\system\explorer.exe
                                        "c:\windows\system\explorer.exe"
                                        8⤵
                                          PID:1852
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    PID:4860
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                        PID:5624
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:4976
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                          PID:2440
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        PID:5756
                                        • \??\c:\windows\system\spoolsv.exe
                                          "c:\windows\system\spoolsv.exe"
                                          6⤵
                                            PID:4576
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Executes dropped EXE
                                          • Drops file in Windows directory
                                          • System Location Discovery: System Language Discovery
                                          PID:3060
                                          • \??\c:\windows\system\spoolsv.exe
                                            "c:\windows\system\spoolsv.exe"
                                            6⤵
                                              PID:720
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            PID:2560
                                            • \??\c:\windows\system\spoolsv.exe
                                              "c:\windows\system\spoolsv.exe"
                                              6⤵
                                                PID:3252
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Executes dropped EXE
                                              • Drops file in Windows directory
                                              • System Location Discovery: System Language Discovery
                                              PID:1016
                                              • \??\c:\windows\system\spoolsv.exe
                                                "c:\windows\system\spoolsv.exe"
                                                6⤵
                                                  PID:5448
                                                  • \??\c:\windows\system\explorer.exe
                                                    c:\windows\system\explorer.exe
                                                    7⤵
                                                      PID:4908
                                                      • \??\c:\windows\system\explorer.exe
                                                        "c:\windows\system\explorer.exe"
                                                        8⤵
                                                          PID:968
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1480
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      "c:\windows\system\spoolsv.exe"
                                                      6⤵
                                                        PID:4452
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Drops file in Windows directory
                                                      • System Location Discovery: System Language Discovery
                                                      PID:3920
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        "c:\windows\system\spoolsv.exe"
                                                        6⤵
                                                          PID:1332
                                                          • \??\c:\windows\system\explorer.exe
                                                            c:\windows\system\explorer.exe
                                                            7⤵
                                                              PID:5136
                                                              • \??\c:\windows\system\explorer.exe
                                                                "c:\windows\system\explorer.exe"
                                                                8⤵
                                                                  PID:1816
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1364
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              "c:\windows\system\spoolsv.exe"
                                                              6⤵
                                                                PID:1760
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Drops file in Windows directory
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2492
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                "c:\windows\system\spoolsv.exe"
                                                                6⤵
                                                                  PID:124
                                                                  • \??\c:\windows\system\explorer.exe
                                                                    c:\windows\system\explorer.exe
                                                                    7⤵
                                                                      PID:3496
                                                                      • \??\c:\windows\system\explorer.exe
                                                                        "c:\windows\system\explorer.exe"
                                                                        8⤵
                                                                          PID:5368
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe SE
                                                                    5⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:5304
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      "c:\windows\system\spoolsv.exe"
                                                                      6⤵
                                                                        PID:4856
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in Windows directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4052
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        "c:\windows\system\spoolsv.exe"
                                                                        6⤵
                                                                          PID:5924
                                                                          • \??\c:\windows\system\explorer.exe
                                                                            c:\windows\system\explorer.exe
                                                                            7⤵
                                                                              PID:3556
                                                                              • \??\c:\windows\system\explorer.exe
                                                                                "c:\windows\system\explorer.exe"
                                                                                8⤵
                                                                                  PID:5364
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3340
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              "c:\windows\system\spoolsv.exe"
                                                                              6⤵
                                                                                PID:1200
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe SE
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              • Drops file in Windows directory
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:3176
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                "c:\windows\system\spoolsv.exe"
                                                                                6⤵
                                                                                  PID:2428
                                                                                  • \??\c:\windows\system\explorer.exe
                                                                                    c:\windows\system\explorer.exe
                                                                                    7⤵
                                                                                      PID:1980
                                                                                      • \??\c:\windows\system\explorer.exe
                                                                                        "c:\windows\system\explorer.exe"
                                                                                        8⤵
                                                                                          PID:4068
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:4584
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      "c:\windows\system\spoolsv.exe"
                                                                                      6⤵
                                                                                        PID:4884
                                                                                        • \??\c:\windows\system\explorer.exe
                                                                                          c:\windows\system\explorer.exe
                                                                                          7⤵
                                                                                            PID:4968
                                                                                            • \??\c:\windows\system\explorer.exe
                                                                                              "c:\windows\system\explorer.exe"
                                                                                              8⤵
                                                                                                PID:5676
                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                          5⤵
                                                                                            PID:4320
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              "c:\windows\system\spoolsv.exe"
                                                                                              6⤵
                                                                                                PID:4612
                                                                                                • \??\c:\windows\system\explorer.exe
                                                                                                  c:\windows\system\explorer.exe
                                                                                                  7⤵
                                                                                                    PID:5192
                                                                                                    • \??\c:\windows\system\explorer.exe
                                                                                                      "c:\windows\system\explorer.exe"
                                                                                                      8⤵
                                                                                                        PID:2016
                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                  5⤵
                                                                                                    PID:2240
                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                      "c:\windows\system\spoolsv.exe"
                                                                                                      6⤵
                                                                                                        PID:2424
                                                                                                        • \??\c:\windows\system\explorer.exe
                                                                                                          c:\windows\system\explorer.exe
                                                                                                          7⤵
                                                                                                            PID:2720
                                                                                                            • \??\c:\windows\system\explorer.exe
                                                                                                              "c:\windows\system\explorer.exe"
                                                                                                              8⤵
                                                                                                                PID:5672
                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                          5⤵
                                                                                                            PID:236
                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                              "c:\windows\system\spoolsv.exe"
                                                                                                              6⤵
                                                                                                                PID:4100
                                                                                                                • \??\c:\windows\system\explorer.exe
                                                                                                                  c:\windows\system\explorer.exe
                                                                                                                  7⤵
                                                                                                                    PID:4036
                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                5⤵
                                                                                                                  PID:1092
                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                    "c:\windows\system\spoolsv.exe"
                                                                                                                    6⤵
                                                                                                                      PID:2396
                                                                                                                      • \??\c:\windows\system\explorer.exe
                                                                                                                        c:\windows\system\explorer.exe
                                                                                                                        7⤵
                                                                                                                          PID:4248
                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                      5⤵
                                                                                                                        PID:5592
                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                          "c:\windows\system\spoolsv.exe"
                                                                                                                          6⤵
                                                                                                                            PID:3464
                                                                                                                            • \??\c:\windows\system\explorer.exe
                                                                                                                              c:\windows\system\explorer.exe
                                                                                                                              7⤵
                                                                                                                                PID:4756
                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                            5⤵
                                                                                                                              PID:1688
                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                "c:\windows\system\spoolsv.exe"
                                                                                                                                6⤵
                                                                                                                                  PID:808
                                                                                                                                  • \??\c:\windows\system\explorer.exe
                                                                                                                                    c:\windows\system\explorer.exe
                                                                                                                                    7⤵
                                                                                                                                      PID:1876
                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                  5⤵
                                                                                                                                    PID:1516
                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                      "c:\windows\system\spoolsv.exe"
                                                                                                                                      6⤵
                                                                                                                                        PID:4972
                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                      5⤵
                                                                                                                                        PID:4236
                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                          "c:\windows\system\spoolsv.exe"
                                                                                                                                          6⤵
                                                                                                                                            PID:4208
                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                          5⤵
                                                                                                                                            PID:6136
                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                              "c:\windows\system\spoolsv.exe"
                                                                                                                                              6⤵
                                                                                                                                                PID:5764
                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                              5⤵
                                                                                                                                                PID:3160
                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                  "c:\windows\system\spoolsv.exe"
                                                                                                                                                  6⤵
                                                                                                                                                    PID:4724
                                                                                                                                                    • \??\c:\windows\system\explorer.exe
                                                                                                                                                      c:\windows\system\explorer.exe
                                                                                                                                                      7⤵
                                                                                                                                                        PID:1084
                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                    5⤵
                                                                                                                                                      PID:1100
                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                        "c:\windows\system\spoolsv.exe"
                                                                                                                                                        6⤵
                                                                                                                                                          PID:912
                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                        5⤵
                                                                                                                                                          PID:2140
                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                            "c:\windows\system\spoolsv.exe"
                                                                                                                                                            6⤵
                                                                                                                                                              PID:240
                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                            5⤵
                                                                                                                                                              PID:2992
                                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                "c:\windows\system\spoolsv.exe"
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:4548
                                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:5692
                                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                    "c:\windows\system\spoolsv.exe"
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:1280
                                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:5680
                                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                        "c:\windows\system\spoolsv.exe"
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:2980
                                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:5052
                                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                            "c:\windows\system\spoolsv.exe"
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:2096
                                                                                                                                                                              • \??\c:\windows\system\explorer.exe
                                                                                                                                                                                c:\windows\system\explorer.exe
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:6092
                                                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:1916
                                                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                  "c:\windows\system\spoolsv.exe"
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:4352
                                                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:5484
                                                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:2028
                                                                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:5140
                                                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:1124
                                                                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:3548
                                                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:4872
                                                                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:1476
                                                                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:1108
                                                                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:3752
                                                                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                      PID:4828
                                                                                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:2904
                                                                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                          PID:5940
                                                                                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                            PID:6084
                                                                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                              PID:3660
                                                                                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:400
                                                                                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:3844
                                                                                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                    PID:2204
                                                                                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                      PID:5108
                                                                                                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                        PID:1236
                                                                                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:5884
                                                                                                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                            PID:444
                                                                                                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:1532
                                                                                                                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:1012
                                                                                                                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:5684
                                                                                                                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                    PID:5032
                                                                                                                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:1248
                                                                                                                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                        PID:5300
                                                                                                                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:1372
                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:5028
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c c:\windows\system\explorer.exe RO
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                    PID:4292
                                                                                                                                                                                                                                    • \??\c:\windows\system\explorer.exe
                                                                                                                                                                                                                                      c:\windows\system\explorer.exe RO
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:1404
                                                                                                                                                                                                                                      • \??\c:\windows\system\explorer.exe
                                                                                                                                                                                                                                        "c:\windows\system\explorer.exe"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:3592
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c c:\windows\system\svchost.exe RO
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:5576

                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                            • C:\Windows\Parameters.ini

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              74B

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              6687785d6a31cdf9a5f80acb3abc459b

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                                                                                                                                                                                                                            • C:\Windows\System\explorer.exe

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              2.2MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              102fbdf641a72cc626b916f73a127ab3

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              dea883fa3f1f70f0eee9cd00b95db68a155b3b2b

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              d63cd4a77b5e2b4e1a31be59b95ea97fc005d053f25029ea05c7bf8f109e2558

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              21915a419f06f1f90412cefed270a14cdb16d42448c43385844368f5d8e3267ce60d043aeda30703f8fdec3168785a73fe0fec147be99b3677176803e4ab1fce

                                                                                                                                                                                                                                            • C:\Windows\System\spoolsv.exe

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              2.2MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              04b1a8a4de5d0015236fb38845e8fc54

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              62b73632a827773ce08b6bb12212dab5f92b1d65

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              01f89236e2eb49c644941b941ca4ed32f3b8a6c352a46a4b169be686d6b1d9c7

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              65a65eb611dc62fe9f698afa35517209bb8c88b996481c487617ebf49178ccb37226548d51c9f0f762ef0fe5cbc038abb528196dcf63acb82248ef84181c97d1

                                                                                                                                                                                                                                            • memory/124-1557-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/124-1528-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/240-3297-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/808-3126-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/808-3236-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/912-3281-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/964-608-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/968-3133-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/1016-895-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/1200-1622-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/1204-726-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/1208-535-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/1208-1061-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/1332-1511-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/1332-1438-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/1364-976-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/1392-1060-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/1392-1055-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/1404-536-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/1404-1056-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/1480-942-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/1664-0-0x00000000008B0000-0x00000000008B1000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                            • memory/1664-37-0x00000000008B0000-0x00000000008B1000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                            • memory/1664-45-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/1664-36-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/1760-1460-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/1816-3166-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/1852-3076-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/2008-1144-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/2016-3391-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/2096-3405-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/2396-2619-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/2396-2673-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/2424-2031-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/2428-1765-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/2440-1209-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/2492-1023-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/2508-1107-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/2560-893-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/3060-855-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/3100-461-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/3100-1044-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/3132-89-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/3132-95-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/3176-1069-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/3252-1273-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/3252-1277-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/3340-1047-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/3464-2992-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/3492-2762-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/3508-460-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/3508-94-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/3508-3069-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/3592-1067-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/3748-572-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/3748-1076-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/3920-959-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/4052-1042-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/4068-3307-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/4100-2047-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/4208-3154-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/4452-1331-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/4548-3320-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/4576-1219-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/4584-1077-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/4612-1957-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/4724-3267-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/4764-40-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/4764-58-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/4764-39-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/4860-746-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/4884-1847-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/4884-1793-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/4976-781-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/4988-679-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/5056-1181-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/5056-1295-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/5304-1035-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/5364-3270-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/5368-3189-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/5416-1078-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/5448-1372-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/5448-1314-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/5504-1119-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/5624-1199-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/5676-3338-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/5748-644-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/5756-819-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                            • memory/5764-3175-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/5764-3182-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/5780-1043-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/5780-1174-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/5924-1615-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB