Overview

overview

10

Static

static

10

05e6896dc7...18.exe

windows7-x64

10

05e6896dc7...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 19:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    05e6896dc7636ea3259b491e4d5e219c_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    05e6896dc7636ea3259b491e4d5e219c

  • SHA1

    a9d4db8ee68a88fa7686f8c5203693cba75f3d1c

  • SHA256

    09c6f3bfa0610816e90babe1ad0e74aabd8310c2e6fb155a03db873f175d7d97

  • SHA512

    2521eb6094c59720ed47f4b48cd39de9462c4c0f426052568a454d4a1c9ddc2952c0ca8b8662476e9657d25fc2df6530f98f1bcdee8f6086f4e1fba4a43195f2

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ+:0UzeyQMS4DqodCnoe+iitjWwwy

Score
10/10
ponyevasionpersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 47 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05e6896dc7636ea3259b491e4d5e219c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\05e6896dc7636ea3259b491e4d5e219c_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3772
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:4716
      • C:\Users\Admin\AppData\Local\Temp\05e6896dc7636ea3259b491e4d5e219c_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\05e6896dc7636ea3259b491e4d5e219c_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3856
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:3652
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1528
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:1696
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:444
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1908
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:2356
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2160
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4600
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3256
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3576
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4036
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:4068
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:752
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:676
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4428
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4584
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:2620
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:5008
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4512
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3460
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3420
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2208
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3424
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2164
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4608
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4788
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:2408
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4888
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:2168
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4600
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1060
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:764
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4288
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1456
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3116
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3068
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4468
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1784
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3888
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1948
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:3796
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                          PID:4648
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:2348
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:3028
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:3272
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:5036
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:2756
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1000
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:2768
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1384
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:740
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                            PID:3196
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:3364
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:2212
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:4212
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:4844
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:4400
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:1740
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:2540
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:3772
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          7⤵
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:2388
                          • \??\c:\windows\system\explorer.exe
                            "c:\windows\system\explorer.exe"
                            8⤵
                              PID:1904
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:4440
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:4872
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:3788
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:4768
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        PID:2372
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:932
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:1576
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:1196
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:4688
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                            PID:708
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:1208
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:4980
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:2244
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:628
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Drops file in Windows directory
                              PID:528
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                  PID:4092
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                PID:3760
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                    PID:1516
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      7⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      PID:2692
                                      • \??\c:\windows\system\explorer.exe
                                        "c:\windows\system\explorer.exe"
                                        8⤵
                                          PID:3060
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • Drops file in Windows directory
                                    PID:4000
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                        PID:1784
                                        • \??\c:\windows\system\explorer.exe
                                          c:\windows\system\explorer.exe
                                          7⤵
                                          • Drops file in Windows directory
                                          PID:4444
                                          • \??\c:\windows\system\explorer.exe
                                            "c:\windows\system\explorer.exe"
                                            8⤵
                                              PID:336
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • Drops file in Windows directory
                                        PID:228
                                        • \??\c:\windows\system\spoolsv.exe
                                          "c:\windows\system\spoolsv.exe"
                                          6⤵
                                            PID:2820
                                            • \??\c:\windows\system\explorer.exe
                                              c:\windows\system\explorer.exe
                                              7⤵
                                                PID:1428
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            PID:2844
                                            • \??\c:\windows\system\spoolsv.exe
                                              "c:\windows\system\spoolsv.exe"
                                              6⤵
                                                PID:1144
                                                • \??\c:\windows\system\explorer.exe
                                                  c:\windows\system\explorer.exe
                                                  7⤵
                                                  • Drops file in Windows directory
                                                  PID:1524
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Drops file in Windows directory
                                              PID:3452
                                              • \??\c:\windows\system\spoolsv.exe
                                                "c:\windows\system\spoolsv.exe"
                                                6⤵
                                                  PID:1752
                                                  • \??\c:\windows\system\explorer.exe
                                                    c:\windows\system\explorer.exe
                                                    7⤵
                                                    • Drops file in Windows directory
                                                    PID:532
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Suspicious use of SetThreadContext
                                                • Drops file in Windows directory
                                                PID:4216
                                                • \??\c:\windows\system\spoolsv.exe
                                                  "c:\windows\system\spoolsv.exe"
                                                  6⤵
                                                    PID:2304
                                                    • \??\c:\windows\system\explorer.exe
                                                      c:\windows\system\explorer.exe
                                                      7⤵
                                                      • Drops file in Windows directory
                                                      PID:2996
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                  • Suspicious use of SetThreadContext
                                                  PID:1940
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    "c:\windows\system\spoolsv.exe"
                                                    6⤵
                                                      PID:1236
                                                      • \??\c:\windows\system\explorer.exe
                                                        c:\windows\system\explorer.exe
                                                        7⤵
                                                          PID:2840
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                        PID:3180
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          "c:\windows\system\spoolsv.exe"
                                                          6⤵
                                                            PID:1612
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Drops file in Windows directory
                                                          PID:424
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            "c:\windows\system\spoolsv.exe"
                                                            6⤵
                                                              PID:4328
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                              PID:5020
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                "c:\windows\system\spoolsv.exe"
                                                                6⤵
                                                                  PID:4472
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                5⤵
                                                                • Drops file in Windows directory
                                                                PID:3776
                                                                • \??\c:\windows\system\spoolsv.exe
                                                                  "c:\windows\system\spoolsv.exe"
                                                                  6⤵
                                                                    PID:1684
                                                                    • \??\c:\windows\system\explorer.exe
                                                                      c:\windows\system\explorer.exe
                                                                      7⤵
                                                                        PID:4984
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe SE
                                                                    5⤵
                                                                    • Drops file in Windows directory
                                                                    PID:4532
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      "c:\windows\system\spoolsv.exe"
                                                                      6⤵
                                                                        PID:3464
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                      • Drops file in Windows directory
                                                                      PID:4392
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        "c:\windows\system\spoolsv.exe"
                                                                        6⤵
                                                                          PID:364
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                        • Drops file in Windows directory
                                                                        PID:1840
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          "c:\windows\system\spoolsv.exe"
                                                                          6⤵
                                                                            PID:4548
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                          • Drops file in Windows directory
                                                                          PID:436
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            "c:\windows\system\spoolsv.exe"
                                                                            6⤵
                                                                              PID:2696
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                              PID:3348
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                "c:\windows\system\spoolsv.exe"
                                                                                6⤵
                                                                                  PID:1368
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                  PID:5112
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    "c:\windows\system\spoolsv.exe"
                                                                                    6⤵
                                                                                      PID:4336
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    5⤵
                                                                                    • Drops file in Windows directory
                                                                                    PID:968
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      "c:\windows\system\spoolsv.exe"
                                                                                      6⤵
                                                                                        PID:1960
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      5⤵
                                                                                        PID:60
                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                          "c:\windows\system\spoolsv.exe"
                                                                                          6⤵
                                                                                            PID:1052
                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                          5⤵
                                                                                          • Drops file in Windows directory
                                                                                          PID:4660
                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                            "c:\windows\system\spoolsv.exe"
                                                                                            6⤵
                                                                                              PID:3432
                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                            5⤵
                                                                                              PID:4368
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                "c:\windows\system\spoolsv.exe"
                                                                                                6⤵
                                                                                                  PID:2588
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                5⤵
                                                                                                • Drops file in Windows directory
                                                                                                PID:4592
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                5⤵
                                                                                                  PID:1264
                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                  5⤵
                                                                                                  • Drops file in Windows directory
                                                                                                  PID:3416
                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                  5⤵
                                                                                                  • Drops file in Windows directory
                                                                                                  PID:452
                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                  5⤵
                                                                                                    PID:2580
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                    5⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    PID:4232
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                    5⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    PID:3136
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                    5⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    PID:3368
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                    5⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    PID:816
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                    5⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    PID:4564
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                    5⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    PID:1220
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                    5⤵
                                                                                                      PID:3220
                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                      5⤵
                                                                                                        PID:2900
                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                        5⤵
                                                                                                          PID:3344
                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                          5⤵
                                                                                                            PID:4356
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                                                                                    1⤵
                                                                                                      PID:2144

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • C:\Windows\Parameters.ini
                                                                                                      MD5

                                                                                                      d41d8cd98f00b204e9800998ecf8427e

                                                                                                      SHA1

                                                                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                      SHA256

                                                                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                      SHA512

                                                                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                      Download Submit
                                                                                                    • C:\Windows\Parameters.ini
                                                                                                      Filesize

                                                                                                      74B

                                                                                                      MD5

                                                                                                      6687785d6a31cdf9a5f80acb3abc459b

                                                                                                      SHA1

                                                                                                      1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                                                                                      SHA256

                                                                                                      3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                                                                                      SHA512

                                                                                                      5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                                                                                      Download Submit
                                                                                                    • C:\Windows\System\explorer.exe
                                                                                                      Filesize

                                                                                                      2.2MB

                                                                                                      MD5

                                                                                                      402357b238170c88b0af19a4c6c80f1c

                                                                                                      SHA1

                                                                                                      97d1afbd406de9c4873307229d6fd29e35b5b4b6

                                                                                                      SHA256

                                                                                                      a6cd8be25decb311ce80ce11caff68101a4107328f9edaaf28c4d12857c0f2b4

                                                                                                      SHA512

                                                                                                      9042ce12bd0cd2882875e9150d2fdb7b848dbc7334a9d3866bca7b89270ae0073ace3e2c9ad8c91a3799191b2e607bdcd038e6698f00e1a71fc497b88ffce1d2

                                                                                                      Download Submit
                                                                                                    • C:\Windows\System\spoolsv.exe
                                                                                                      Filesize

                                                                                                      2.2MB

                                                                                                      MD5

                                                                                                      6bb1c74c5de5dd068e77d71232f8f63c

                                                                                                      SHA1

                                                                                                      937846e359a1b7f6bf05120f7e363b95c839d134

                                                                                                      SHA256

                                                                                                      d880669c861d92af2e9ba4b5646b14dcd97dcfbfe90f23c48bf8b1c3f6f48d6b

                                                                                                      SHA512

                                                                                                      5b3daa179fb745f5594ec1efa6f5636e76702bff8008ec49ec5a19339bb3f401dd1f8db65d95a981e9139b8752dab1e06bab7f716450f410306d8ac16dc82e64

                                                                                                      Download Submit
                                                                                                    • memory/336-5632-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/364-5816-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/444-2208-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/444-2380-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/628-3143-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/676-2408-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/708-3127-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/752-1278-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/764-2579-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/932-3105-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1000-2781-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1000-2786-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1060-1811-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/1144-4665-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1236-5506-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1236-5669-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1384-3056-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1384-2927-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1456-2588-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1516-3306-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1516-3417-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1528-1074-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1528-99-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1684-5724-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1696-2209-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/1696-1075-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/1740-2968-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1740-2954-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1752-4847-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1784-3698-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1784-2607-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1784-2609-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1904-5291-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1904-5295-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1948-2690-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/1960-5882-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/2160-2301-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/2160-1076-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/2164-2539-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/2168-1622-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/2208-2531-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/2212-2937-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/2212-2935-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/2304-5403-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/2304-5283-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/2348-1964-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/2356-3315-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/2408-1621-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/2540-2398-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/2620-1426-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/2756-2199-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/2768-2200-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/2820-4523-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/3028-2743-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/3060-5517-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/3068-2597-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/3068-2601-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/3116-1813-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/3196-4858-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/3196-4855-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/3256-2400-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/3256-1277-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/3272-1965-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/3364-2207-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/3420-1428-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/3424-1619-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/3460-2520-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/3464-5732-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/3576-2399-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/3652-100-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/3652-94-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/3772-38-0x0000000002330000-0x0000000002331000-memory.dmp
                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download
                                                                                                    • memory/3772-3077-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/3772-36-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/3772-3277-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/3772-42-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/3772-0-0x0000000002330000-0x0000000002331000-memory.dmp
                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      Download
                                                                                                    • memory/3856-39-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/3856-41-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/3856-83-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/3888-1963-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/4068-4307-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/4092-3226-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/4212-2304-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/4288-1812-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/4328-5611-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/4400-2305-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/4428-1279-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/4468-1814-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/4512-1427-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/4548-5841-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/4584-2420-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/4600-2306-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/4600-2569-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/4600-2300-0x0000000000440000-0x0000000000509000-memory.dmp
                                                                                                      Filesize

                                                                                                      804KB

                                                                                                      Download
                                                                                                    • memory/4608-1620-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                      Download
                                                                                                    • memory/4648-4546-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/4768-3096-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/4788-2549-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/4844-2948-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/4872-3085-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/4888-2559-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/4980-3134-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/5008-2506-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download
                                                                                                    • memory/5036-2774-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                      Filesize

                                                                                                      248KB

                                                                                                      Download