Overview

overview

10

Static

static

10

04b0fd4f6b...18.exe

windows7-x64

10

04b0fd4f6b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    53s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 07:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    04b0fd4f6bf3d89cb9c8bd9e7da279e6_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    04b0fd4f6bf3d89cb9c8bd9e7da279e6

  • SHA1

    5b88eadbb28bd5bb1251b1cee96999a919f7f209

  • SHA256

    30aa783d70820926e668737bea5c8462b1fc72dc04a5378cf43ca8c1a5783be1

  • SHA512

    7aad3666e72be2de3b731b22fc9c60e4a0f60b4c51c3d15b8da06c42e1149daa647614890c6b569243ec096820cfd2d05540be951da3f23556ee85f678a94ae3

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ5:0UzeyQMS4DqodCnoe+iitjWwwd

Score
10/10
ponyevasionpersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 58 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04b0fd4f6bf3d89cb9c8bd9e7da279e6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\04b0fd4f6bf3d89cb9c8bd9e7da279e6_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2624
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:4740
      • C:\Users\Admin\AppData\Local\Temp\04b0fd4f6bf3d89cb9c8bd9e7da279e6_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\04b0fd4f6bf3d89cb9c8bd9e7da279e6_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3404
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:3268
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3320
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:4092
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3376
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3792
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:1644
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4724
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:972
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3748
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3356
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2780
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3532
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4504
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3100
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1808
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2016
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4760
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4476
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:3252
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:1256
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1388
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:372
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3956
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4732
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4764
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3012
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1452
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4700
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:5088
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                          PID:4508
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:1936
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4636
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:384
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:924
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:2316
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4980
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:1268
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4372
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:1852
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                            PID:3504
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:4284
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1348
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:664
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:4544
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:4072
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2972
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:4088
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:3984
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:812
                          • \??\c:\windows\system\explorer.exe
                            "c:\windows\system\explorer.exe"
                            8⤵
                              PID:4560
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:1164
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:2028
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:3156
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:4236
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:4336
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:556
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:1620
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:5068
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:4972
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:4940
                          • \??\c:\windows\system\explorer.exe
                            c:\windows\system\explorer.exe
                            7⤵
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:1556
                            • \??\c:\windows\system\explorer.exe
                              "c:\windows\system\explorer.exe"
                              8⤵
                                PID:816
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:3976
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:2236
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:2340
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:1420
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:2740
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:3040
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:4364
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:4588
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              7⤵
                              • Suspicious use of SetThreadContext
                              • Drops file in Windows directory
                              PID:688
                              • \??\c:\windows\system\explorer.exe
                                "c:\windows\system\explorer.exe"
                                8⤵
                                  PID:512
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:4168
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:760
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:4116
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:636
                                • \??\c:\windows\system\explorer.exe
                                  c:\windows\system\explorer.exe
                                  7⤵
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  PID:2664
                                  • \??\c:\windows\system\explorer.exe
                                    "c:\windows\system\explorer.exe"
                                    8⤵
                                      PID:1516
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                PID:2988
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                    PID:4668
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      7⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      PID:4464
                                      • \??\c:\windows\system\explorer.exe
                                        "c:\windows\system\explorer.exe"
                                        8⤵
                                          PID:4928
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • Drops file in Windows directory
                                    PID:1204
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                        PID:1576
                                        • \??\c:\windows\system\explorer.exe
                                          c:\windows\system\explorer.exe
                                          7⤵
                                          • Suspicious use of SetThreadContext
                                          • Drops file in Windows directory
                                          PID:5048
                                          • \??\c:\windows\system\explorer.exe
                                            "c:\windows\system\explorer.exe"
                                            8⤵
                                              PID:4540
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        PID:4524
                                        • \??\c:\windows\system\spoolsv.exe
                                          "c:\windows\system\spoolsv.exe"
                                          6⤵
                                            PID:4084
                                            • \??\c:\windows\system\explorer.exe
                                              c:\windows\system\explorer.exe
                                              7⤵
                                              • Drops file in Windows directory
                                              PID:4412
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          PID:2724
                                          • \??\c:\windows\system\spoolsv.exe
                                            "c:\windows\system\spoolsv.exe"
                                            6⤵
                                              PID:3568
                                              • \??\c:\windows\system\explorer.exe
                                                c:\windows\system\explorer.exe
                                                7⤵
                                                • Drops file in Windows directory
                                                PID:4680
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            PID:4736
                                            • \??\c:\windows\system\spoolsv.exe
                                              "c:\windows\system\spoolsv.exe"
                                              6⤵
                                                PID:3084
                                                • \??\c:\windows\system\explorer.exe
                                                  c:\windows\system\explorer.exe
                                                  7⤵
                                                  • Drops file in Windows directory
                                                  PID:4992
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Suspicious use of SetThreadContext
                                              • Drops file in Windows directory
                                              PID:3184
                                              • \??\c:\windows\system\spoolsv.exe
                                                "c:\windows\system\spoolsv.exe"
                                                6⤵
                                                  PID:2552
                                                  • \??\c:\windows\system\explorer.exe
                                                    c:\windows\system\explorer.exe
                                                    7⤵
                                                    • Drops file in Windows directory
                                                    PID:2084
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Suspicious use of SetThreadContext
                                                • Drops file in Windows directory
                                                PID:4956
                                                • \??\c:\windows\system\spoolsv.exe
                                                  "c:\windows\system\spoolsv.exe"
                                                  6⤵
                                                    PID:3204
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                  • Suspicious use of SetThreadContext
                                                  PID:4860
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    "c:\windows\system\spoolsv.exe"
                                                    6⤵
                                                      PID:5032
                                                      • \??\c:\windows\system\explorer.exe
                                                        c:\windows\system\explorer.exe
                                                        7⤵
                                                        • Drops file in Windows directory
                                                        PID:5028
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                    • Suspicious use of SetThreadContext
                                                    • Drops file in Windows directory
                                                    PID:2244
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      "c:\windows\system\spoolsv.exe"
                                                      6⤵
                                                        PID:1200
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                      • Suspicious use of SetThreadContext
                                                      • Drops file in Windows directory
                                                      PID:3652
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        "c:\windows\system\spoolsv.exe"
                                                        6⤵
                                                          PID:3484
                                                          • \??\c:\windows\system\explorer.exe
                                                            c:\windows\system\explorer.exe
                                                            7⤵
                                                              PID:4664
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Suspicious use of SetThreadContext
                                                          PID:3192
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            "c:\windows\system\spoolsv.exe"
                                                            6⤵
                                                              PID:3840
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                            • Suspicious use of SetThreadContext
                                                            PID:4248
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              "c:\windows\system\spoolsv.exe"
                                                              6⤵
                                                                PID:4696
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Suspicious use of SetThreadContext
                                                              • Drops file in Windows directory
                                                              PID:3872
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                "c:\windows\system\spoolsv.exe"
                                                                6⤵
                                                                  PID:4776
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                5⤵
                                                                • Suspicious use of SetThreadContext
                                                                PID:2276
                                                                • \??\c:\windows\system\spoolsv.exe
                                                                  "c:\windows\system\spoolsv.exe"
                                                                  6⤵
                                                                    PID:1664
                                                                    • \??\c:\windows\system\explorer.exe
                                                                      c:\windows\system\explorer.exe
                                                                      7⤵
                                                                        PID:3264
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe SE
                                                                    5⤵
                                                                    • Suspicious use of SetThreadContext
                                                                    • Drops file in Windows directory
                                                                    PID:2864
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      "c:\windows\system\spoolsv.exe"
                                                                      6⤵
                                                                        PID:4876
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                      • Suspicious use of SetThreadContext
                                                                      • Drops file in Windows directory
                                                                      PID:3028
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        "c:\windows\system\spoolsv.exe"
                                                                        6⤵
                                                                          PID:4704
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                          PID:4932
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                          • Drops file in Windows directory
                                                                          PID:4124
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                          • Drops file in Windows directory
                                                                          PID:1152
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                          • Drops file in Windows directory
                                                                          PID:1720
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                          • Drops file in Windows directory
                                                                          PID:4564
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                          • Drops file in Windows directory
                                                                          PID:4064
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                            PID:4608
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                            • Drops file in Windows directory
                                                                            PID:5116
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                            • Drops file in Windows directory
                                                                            PID:2136
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                            • Drops file in Windows directory
                                                                            PID:4584
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                            • Drops file in Windows directory
                                                                            PID:3524
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                              PID:1208
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe SE
                                                                              5⤵
                                                                                PID:456
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                  PID:4296
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                                                          1⤵
                                                                            PID:1456

                                                                          Network

                                                                          MITRE ATT&CK Matrix ATT&CK v13

                                                                          Initial Access

                                                                          Execution

                                                                          Persistence

                                                                          Boot or Logon Autostart Execution

                                                                          3
                                                                          T1547

                                                                          Registry Run Keys / Startup Folder

                                                                          2
                                                                          T1547.001

                                                                          Winlogon Helper DLL

                                                                          1
                                                                          T1547.004

                                                                          Privilege Escalation

                                                                          Boot or Logon Autostart Execution

                                                                          3
                                                                          T1547

                                                                          Registry Run Keys / Startup Folder

                                                                          2
                                                                          T1547.001

                                                                          Winlogon Helper DLL

                                                                          1
                                                                          T1547.004

                                                                          Defense Evasion

                                                                          Modify Registry

                                                                          4
                                                                          T1112

                                                                          Hide Artifacts

                                                                          1
                                                                          T1564

                                                                          Hidden Files and Directories

                                                                          1
                                                                          T1564.001

                                                                          Credential Access

                                                                          Discovery

                                                                          System Information Discovery

                                                                          1
                                                                          T1082

                                                                          Lateral Movement

                                                                          Collection

                                                                          Exfiltration

                                                                          Command and Control

                                                                          Impact

                                                                          Resource Development

                                                                          Reconnaissance

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          • C:\Windows\Parameters.ini
                                                                            Filesize

                                                                            74B

                                                                            MD5

                                                                            6687785d6a31cdf9a5f80acb3abc459b

                                                                            SHA1

                                                                            1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                                                            SHA256

                                                                            3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                                                            SHA512

                                                                            5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                                                            Download Submit
                                                                          • C:\Windows\System\explorer.exe
                                                                            Filesize

                                                                            2.2MB

                                                                            MD5

                                                                            04ceb237af76039bf5ad8568fde2d7c0

                                                                            SHA1

                                                                            ee9842d5e18eded0d26f89df1a75696141491510

                                                                            SHA256

                                                                            7e4a8ac99cb8385012f3331bd6ed9266a7827961b432a443c5d709b616ce086c

                                                                            SHA512

                                                                            8ed8d788f7fe5ac16a8eac0329076c6268fc7d84c02e23eb4fd7b83f86b90e1bf0c8d186d18246e18277be1c314a75ab5caf14f409ab3df5a392e13eec1d1567

                                                                            Download Submit
                                                                          • C:\Windows\System\spoolsv.exe
                                                                            Filesize

                                                                            2.2MB

                                                                            MD5

                                                                            041f7664cc566d803bb9fb69334f803b

                                                                            SHA1

                                                                            7fc4195f3b8e2b92703c74b958d1a5c60e8fff05

                                                                            SHA256

                                                                            32a18d42e411c2887d79d2b6f4ed22bb87920f8bf4025a74275921905cf94766

                                                                            SHA512

                                                                            b1d1416a90197ba5c155616c0be1d23d7b5ffdfdc2b2226af57f9c97e136951fa47fadd8fffd9b5f526905775b428256f6d16aea7d22c624ea88bee9b42e7278

                                                                            Download Submit
                                                                          • memory/372-2041-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/384-1566-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/512-4841-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/556-2657-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/636-3347-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/636-3209-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/664-1748-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/760-2988-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/816-4676-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/924-2283-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/924-2285-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/972-1834-0x0000000000440000-0x0000000000509000-memory.dmp
                                                                            Filesize

                                                                            804KB

                                                                            Download
                                                                          • memory/972-1833-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/1164-1832-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/1200-4925-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/1200-4928-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/1256-3615-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/1268-1568-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/1348-2472-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/1388-1241-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/1420-2855-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/1452-1395-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/1516-4999-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/1576-3689-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/1576-3806-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/1620-1854-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/1644-3368-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/1644-3366-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/1664-5168-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/1808-1103-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/1936-1396-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/2016-1939-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/2016-1935-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/2028-2637-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/2236-2846-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/2316-1567-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/2552-4815-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/2624-41-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/2624-47-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/2624-43-0x0000000002330000-0x0000000002331000-memory.dmp
                                                                            Filesize

                                                                            4KB

                                                                            Download
                                                                          • memory/2624-0-0x0000000002330000-0x0000000002331000-memory.dmp
                                                                            Filesize

                                                                            4KB

                                                                            Download
                                                                          • memory/2780-931-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/2972-2491-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3012-2116-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3040-2867-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3084-4464-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3084-4586-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3100-1928-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3100-1924-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3156-1842-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/3204-4768-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3204-4771-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3268-88-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/3268-93-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/3320-92-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3320-623-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3356-1844-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3376-1997-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3376-1823-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3404-77-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3404-46-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3404-44-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3484-4992-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3504-4203-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3532-1855-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3568-4334-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/3748-930-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/3748-1843-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/3956-1246-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/3984-2615-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4072-1749-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/4084-3972-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4084-4095-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4088-1822-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/4092-758-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/4092-1818-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/4236-2648-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4284-1747-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/4336-1853-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/4372-2387-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4372-2536-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4476-2017-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4476-2171-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4504-1102-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/4508-3904-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4540-5190-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4544-2482-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4560-4489-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4588-3087-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4636-2275-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4668-3595-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4700-2188-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4700-2334-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4704-5199-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4724-929-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/4724-1829-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/4732-2106-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4760-1104-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/4764-1394-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                            Filesize

                                                                            1.8MB

                                                                            Download
                                                                          • memory/4776-5096-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4876-5177-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4928-5079-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4940-2839-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/4980-2295-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/5032-4917-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/5032-4975-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download
                                                                          • memory/5068-2668-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                            Filesize

                                                                            248KB

                                                                            Download