Overview

overview

10

Static

static

10

24e7b63716...18.exe

windows7-x64

10

24e7b63716...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/05/2024, 12:48 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    24e7b637165474ecdad9da06a84bcb90_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    24e7b637165474ecdad9da06a84bcb90

  • SHA1

    1f37542fd688a87e0c89a42b44700b6c54ec3354

  • SHA256

    7cb6c955e58cb1ab45c5bea8b765310c8659549f07b7bb08649915fff7c8a21a

  • SHA512

    642438c279bf0c146160fad0748a08844f56de5be0b184b6ac3dc6a216c4fddd60299f338f3ac5c7b5d7caa70a1a8cd469404f56d6287078126280152d406599

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ1:0UzeyQMS4DqodCnoe+iitjWwwB

Score
10/10
ponyevasionpersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 53 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\24e7b637165474ecdad9da06a84bcb90_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\24e7b637165474ecdad9da06a84bcb90_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3096
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2376
      • C:\Users\Admin\AppData\Local\Temp\24e7b637165474ecdad9da06a84bcb90_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\24e7b637165474ecdad9da06a84bcb90_JaffaCakes118.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2944
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:1860
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4140
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:3492
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1488
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1632
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:4800
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1056
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:64
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:4276
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1860
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1612
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2772
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:808
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3384
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:5016
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:472
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1732
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3740
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3452
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1436
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:672
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1208
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3928
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4520
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:956
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4264
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:2796
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2328
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:1080
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                          PID:1712
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4888
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4516
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4568
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:3408
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:3992
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:560
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:1904
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:2196
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:3652
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:3076
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:4072
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:2784
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:2332
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                            PID:4080
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:4472
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:3252
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:4456
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2144
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:1596
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:4056
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:1760
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:628
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:4536
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2080
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          7⤵
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:3876
                          • \??\c:\windows\system\explorer.exe
                            "c:\windows\system\explorer.exe"
                            8⤵
                              PID:5288
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:2980
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:4376
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:440
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1964
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:3900
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:2524
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:1500
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:5108
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:4448
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:968
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:4792
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:5104
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:3340
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:4356
                          • \??\c:\windows\system\explorer.exe
                            c:\windows\system\explorer.exe
                            7⤵
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:3096
                            • \??\c:\windows\system\explorer.exe
                              "c:\windows\system\explorer.exe"
                              8⤵
                                PID:5480
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:1240
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:4020
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                PID:5104
                                • \??\c:\windows\system\explorer.exe
                                  "c:\windows\system\explorer.exe"
                                  8⤵
                                    PID:5844
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Drops file in Windows directory
                              PID:2404
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                  PID:1448
                                  • \??\c:\windows\system\explorer.exe
                                    c:\windows\system\explorer.exe
                                    7⤵
                                    • Drops file in Windows directory
                                    PID:2780
                                    • \??\c:\windows\system\explorer.exe
                                      "c:\windows\system\explorer.exe"
                                      8⤵
                                        PID:5760
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  PID:4012
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                      PID:4820
                                      • \??\c:\windows\system\explorer.exe
                                        c:\windows\system\explorer.exe
                                        7⤵
                                        • Drops file in Windows directory
                                        PID:4652
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • Drops file in Windows directory
                                    PID:3892
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                        PID:1868
                                        • \??\c:\windows\system\explorer.exe
                                          c:\windows\system\explorer.exe
                                          7⤵
                                          • Drops file in Windows directory
                                          PID:5020
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      PID:3032
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                          PID:1676
                                          • \??\c:\windows\system\explorer.exe
                                            c:\windows\system\explorer.exe
                                            7⤵
                                              PID:5072
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Suspicious use of SetThreadContext
                                          • Drops file in Windows directory
                                          PID:2072
                                          • \??\c:\windows\system\spoolsv.exe
                                            "c:\windows\system\spoolsv.exe"
                                            6⤵
                                              PID:5280
                                              • \??\c:\windows\system\explorer.exe
                                                c:\windows\system\explorer.exe
                                                7⤵
                                                  PID:5344
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Suspicious use of SetThreadContext
                                              PID:2976
                                              • \??\c:\windows\system\spoolsv.exe
                                                "c:\windows\system\spoolsv.exe"
                                                6⤵
                                                  PID:5436
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Suspicious use of SetThreadContext
                                                • Drops file in Windows directory
                                                PID:4084
                                                • \??\c:\windows\system\spoolsv.exe
                                                  "c:\windows\system\spoolsv.exe"
                                                  6⤵
                                                    PID:5568
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                  • Suspicious use of SetThreadContext
                                                  • Drops file in Windows directory
                                                  PID:1956
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    "c:\windows\system\spoolsv.exe"
                                                    6⤵
                                                      PID:5628
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                    • Suspicious use of SetThreadContext
                                                    PID:2620
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      "c:\windows\system\spoolsv.exe"
                                                      6⤵
                                                        PID:5696
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                      • Suspicious use of SetThreadContext
                                                      PID:1400
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        "c:\windows\system\spoolsv.exe"
                                                        6⤵
                                                          PID:5776
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe SE
                                                        5⤵
                                                        • Suspicious use of SetThreadContext
                                                        • Drops file in Windows directory
                                                        PID:2488
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          "c:\windows\system\spoolsv.exe"
                                                          6⤵
                                                            PID:5912
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Suspicious use of SetThreadContext
                                                          • Drops file in Windows directory
                                                          PID:4400
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            "c:\windows\system\spoolsv.exe"
                                                            6⤵
                                                              PID:5148
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                            • Suspicious use of SetThreadContext
                                                            • Drops file in Windows directory
                                                            PID:4260
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              "c:\windows\system\spoolsv.exe"
                                                              6⤵
                                                                PID:5520
                                                                • \??\c:\windows\system\explorer.exe
                                                                  c:\windows\system\explorer.exe
                                                                  7⤵
                                                                    PID:5456
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                5⤵
                                                                • Suspicious use of SetThreadContext
                                                                • Drops file in Windows directory
                                                                PID:2580
                                                                • \??\c:\windows\system\spoolsv.exe
                                                                  "c:\windows\system\spoolsv.exe"
                                                                  6⤵
                                                                    PID:3792
                                                                • \??\c:\windows\system\spoolsv.exe
                                                                  c:\windows\system\spoolsv.exe SE
                                                                  5⤵
                                                                  • Drops file in Windows directory
                                                                  PID:2740
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    "c:\windows\system\spoolsv.exe"
                                                                    6⤵
                                                                      PID:5652
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe SE
                                                                    5⤵
                                                                    • Drops file in Windows directory
                                                                    PID:1636
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      "c:\windows\system\spoolsv.exe"
                                                                      6⤵
                                                                        PID:5828
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                      • Drops file in Windows directory
                                                                      PID:2908
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        "c:\windows\system\spoolsv.exe"
                                                                        6⤵
                                                                          PID:4040
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                        • Drops file in Windows directory
                                                                        PID:1460
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          "c:\windows\system\spoolsv.exe"
                                                                          6⤵
                                                                            PID:5992
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                          • Drops file in Windows directory
                                                                          PID:2436
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                          • Drops file in Windows directory
                                                                          PID:1332
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                            PID:1480
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                            • Drops file in Windows directory
                                                                            PID:4880
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                            • Drops file in Windows directory
                                                                            PID:2752
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                            • Drops file in Windows directory
                                                                            PID:1792
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                            • Drops file in Windows directory
                                                                            PID:2512
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                            • Drops file in Windows directory
                                                                            PID:3164
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                            • Drops file in Windows directory
                                                                            PID:5180
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                              PID:6132
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe SE
                                                                              5⤵
                                                                                PID:6088
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                                                        1⤵
                                                                          PID:848

                                                                        Network

                                                                        • flag-us
                                                                          DNS
                                                                          104.219.191.52.in-addr.arpa
                                                                          Remote address:
                                                                          8.8.8.8:53
                                                                          Request
                                                                          104.219.191.52.in-addr.arpa
                                                                          IN PTR
                                                                          Response
                                                                        • flag-us
                                                                          DNS
                                                                          249.197.17.2.in-addr.arpa
                                                                          Remote address:
                                                                          8.8.8.8:53
                                                                          Request
                                                                          249.197.17.2.in-addr.arpa
                                                                          IN PTR
                                                                          Response
                                                                          249.197.17.2.in-addr.arpa
                                                                          IN PTR
                                                                          a2-17-197-249deploystaticakamaitechnologiescom
                                                                        • flag-us
                                                                          DNS
                                                                          73.31.126.40.in-addr.arpa
                                                                          Remote address:
                                                                          8.8.8.8:53
                                                                          Request
                                                                          73.31.126.40.in-addr.arpa
                                                                          IN PTR
                                                                          Response
                                                                        • flag-us
                                                                          DNS
                                                                          55.36.223.20.in-addr.arpa
                                                                          Remote address:
                                                                          8.8.8.8:53
                                                                          Request
                                                                          55.36.223.20.in-addr.arpa
                                                                          IN PTR
                                                                          Response
                                                                        • flag-us
                                                                          DNS
                                                                          183.142.211.20.in-addr.arpa
                                                                          Remote address:
                                                                          8.8.8.8:53
                                                                          Request
                                                                          183.142.211.20.in-addr.arpa
                                                                          IN PTR
                                                                          Response
                                                                        • flag-us
                                                                          DNS
                                                                          157.123.68.40.in-addr.arpa
                                                                          Remote address:
                                                                          8.8.8.8:53
                                                                          Request
                                                                          157.123.68.40.in-addr.arpa
                                                                          IN PTR
                                                                          Response
                                                                        • flag-us
                                                                          DNS
                                                                          56.126.166.20.in-addr.arpa
                                                                          Remote address:
                                                                          8.8.8.8:53
                                                                          Request
                                                                          56.126.166.20.in-addr.arpa
                                                                          IN PTR
                                                                          Response
                                                                        • flag-us
                                                                          DNS
                                                                          17.143.109.104.in-addr.arpa
                                                                          Remote address:
                                                                          8.8.8.8:53
                                                                          Request
                                                                          17.143.109.104.in-addr.arpa
                                                                          IN PTR
                                                                          Response
                                                                          17.143.109.104.in-addr.arpa
                                                                          IN PTR
                                                                          a104-109-143-17deploystaticakamaitechnologiescom
                                                                        • flag-us
                                                                          DNS
                                                                          58.99.105.20.in-addr.arpa
                                                                          Remote address:
                                                                          8.8.8.8:53
                                                                          Request
                                                                          58.99.105.20.in-addr.arpa
                                                                          IN PTR
                                                                          Response
                                                                        • flag-us
                                                                          DNS
                                                                          48.251.17.2.in-addr.arpa
                                                                          Remote address:
                                                                          8.8.8.8:53
                                                                          Request
                                                                          48.251.17.2.in-addr.arpa
                                                                          IN PTR
                                                                          Response
                                                                          48.251.17.2.in-addr.arpa
                                                                          IN PTR
                                                                          a2-17-251-48deploystaticakamaitechnologiescom
                                                                        • flag-us
                                                                          DNS
                                                                          43.229.111.52.in-addr.arpa
                                                                          Remote address:
                                                                          8.8.8.8:53
                                                                          Request
                                                                          43.229.111.52.in-addr.arpa
                                                                          IN PTR
                                                                          Response
                                                                        • flag-us
                                                                          DNS
                                                                          43.58.199.20.in-addr.arpa
                                                                          Remote address:
                                                                          8.8.8.8:53
                                                                          Request
                                                                          43.58.199.20.in-addr.arpa
                                                                          IN PTR
                                                                          Response
                                                                        • flag-us
                                                                          DNS
                                                                          tse1.mm.bing.net
                                                                          Remote address:
                                                                          8.8.8.8:53
                                                                          Request
                                                                          tse1.mm.bing.net
                                                                          IN A
                                                                          Response
                                                                          tse1.mm.bing.net
                                                                          IN CNAME
                                                                          mm-mm.bing.net.trafficmanager.net
                                                                          mm-mm.bing.net.trafficmanager.net
                                                                          IN CNAME
                                                                          dual-a-0001.a-msedge.net
                                                                          dual-a-0001.a-msedge.net
                                                                          IN A
                                                                          204.79.197.200
                                                                          dual-a-0001.a-msedge.net
                                                                          IN A
                                                                          13.107.21.200
                                                                        • flag-us
                                                                          GET
                                                                          https://tse1.mm.bing.net/th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                                                                          Remote address:
                                                                          204.79.197.200:443
                                                                          Request
                                                                          GET /th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
                                                                          host: tse1.mm.bing.net
                                                                          accept: */*
                                                                          accept-encoding: gzip, deflate, br
                                                                          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                          Response
                                                                          HTTP/2.0 200
                                                                          cache-control: public, max-age=2592000
                                                                          content-length: 555746
                                                                          content-type: image/jpeg
                                                                          x-cache: TCP_HIT
                                                                          access-control-allow-origin: *
                                                                          access-control-allow-headers: *
                                                                          access-control-allow-methods: GET, POST, OPTIONS
                                                                          timing-allow-origin: *
                                                                          report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
                                                                          nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                          accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                          x-msedge-ref: Ref A: 3F9E071C1D154AD9865D5D275E928E43 Ref B: LON04EDGE0809 Ref C: 2024-05-08T12:50:15Z
                                                                          date: Wed, 08 May 2024 12:50:14 GMT
                                                                        • flag-us
                                                                          GET
                                                                          https://tse1.mm.bing.net/th?id=OADD2.10239351691769_17S178H4I11J3APXJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                                                                          Remote address:
                                                                          204.79.197.200:443
                                                                          Request
                                                                          GET /th?id=OADD2.10239351691769_17S178H4I11J3APXJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
                                                                          host: tse1.mm.bing.net
                                                                          accept: */*
                                                                          accept-encoding: gzip, deflate, br
                                                                          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                          Response
                                                                          HTTP/2.0 200
                                                                          cache-control: public, max-age=2592000
                                                                          content-length: 659775
                                                                          content-type: image/jpeg
                                                                          x-cache: TCP_HIT
                                                                          access-control-allow-origin: *
                                                                          access-control-allow-headers: *
                                                                          access-control-allow-methods: GET, POST, OPTIONS
                                                                          timing-allow-origin: *
                                                                          report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
                                                                          nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                          accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                          x-msedge-ref: Ref A: D7C7281A210845B687224C09B3EB9861 Ref B: LON04EDGE0809 Ref C: 2024-05-08T12:50:15Z
                                                                          date: Wed, 08 May 2024 12:50:14 GMT
                                                                        • flag-us
                                                                          GET
                                                                          https://tse1.mm.bing.net/th?id=OADD2.10239360931612_153L2SVWUYAQUME4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                                                                          Remote address:
                                                                          204.79.197.200:443
                                                                          Request
                                                                          GET /th?id=OADD2.10239360931612_153L2SVWUYAQUME4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
                                                                          host: tse1.mm.bing.net
                                                                          accept: */*
                                                                          accept-encoding: gzip, deflate, br
                                                                          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                          Response
                                                                          HTTP/2.0 200
                                                                          cache-control: public, max-age=2592000
                                                                          content-length: 496166
                                                                          content-type: image/jpeg
                                                                          x-cache: TCP_HIT
                                                                          access-control-allow-origin: *
                                                                          access-control-allow-headers: *
                                                                          access-control-allow-methods: GET, POST, OPTIONS
                                                                          timing-allow-origin: *
                                                                          report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
                                                                          nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                          accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                          x-msedge-ref: Ref A: C6F507024D7A47A5ADD22EF821CE123C Ref B: LON04EDGE0809 Ref C: 2024-05-08T12:50:15Z
                                                                          date: Wed, 08 May 2024 12:50:14 GMT
                                                                        • flag-us
                                                                          GET
                                                                          https://tse1.mm.bing.net/th?id=OADD2.10239360931611_1SOG5TNNJKE1WH1R0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                                                                          Remote address:
                                                                          204.79.197.200:443
                                                                          Request
                                                                          GET /th?id=OADD2.10239360931611_1SOG5TNNJKE1WH1R0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
                                                                          host: tse1.mm.bing.net
                                                                          accept: */*
                                                                          accept-encoding: gzip, deflate, br
                                                                          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                          Response
                                                                          HTTP/2.0 200
                                                                          cache-control: public, max-age=2592000
                                                                          content-length: 621794
                                                                          content-type: image/jpeg
                                                                          x-cache: TCP_HIT
                                                                          access-control-allow-origin: *
                                                                          access-control-allow-headers: *
                                                                          access-control-allow-methods: GET, POST, OPTIONS
                                                                          timing-allow-origin: *
                                                                          report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
                                                                          nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                          accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                          x-msedge-ref: Ref A: 56C0CAEB2A7546378DEC32D00494FB9F Ref B: LON04EDGE0809 Ref C: 2024-05-08T12:50:15Z
                                                                          date: Wed, 08 May 2024 12:50:14 GMT
                                                                        • flag-us
                                                                          GET
                                                                          https://tse1.mm.bing.net/th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                                                                          Remote address:
                                                                          204.79.197.200:443
                                                                          Request
                                                                          GET /th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
                                                                          host: tse1.mm.bing.net
                                                                          accept: */*
                                                                          accept-encoding: gzip, deflate, br
                                                                          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                          Response
                                                                          HTTP/2.0 200
                                                                          cache-control: public, max-age=2592000
                                                                          content-length: 638730
                                                                          content-type: image/jpeg
                                                                          x-cache: TCP_HIT
                                                                          access-control-allow-origin: *
                                                                          access-control-allow-headers: *
                                                                          access-control-allow-methods: GET, POST, OPTIONS
                                                                          timing-allow-origin: *
                                                                          report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
                                                                          nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                          accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                          x-msedge-ref: Ref A: 9629582431124425ACBC7011A404790F Ref B: LON04EDGE0809 Ref C: 2024-05-08T12:50:15Z
                                                                          date: Wed, 08 May 2024 12:50:14 GMT
                                                                        • flag-us
                                                                          GET
                                                                          https://tse1.mm.bing.net/th?id=OADD2.10239351691770_1IUJHOACLFVRNOEKH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                                                                          Remote address:
                                                                          204.79.197.200:443
                                                                          Request
                                                                          GET /th?id=OADD2.10239351691770_1IUJHOACLFVRNOEKH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
                                                                          host: tse1.mm.bing.net
                                                                          accept: */*
                                                                          accept-encoding: gzip, deflate, br
                                                                          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                                                          Response
                                                                          HTTP/2.0 200
                                                                          cache-control: public, max-age=2592000
                                                                          content-length: 496229
                                                                          content-type: image/jpeg
                                                                          x-cache: TCP_HIT
                                                                          access-control-allow-origin: *
                                                                          access-control-allow-headers: *
                                                                          access-control-allow-methods: GET, POST, OPTIONS
                                                                          timing-allow-origin: *
                                                                          report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
                                                                          nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                                                          accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                          x-msedge-ref: Ref A: 49952617C8354A899CAA578EA29042FA Ref B: LON04EDGE0809 Ref C: 2024-05-08T12:50:16Z
                                                                          date: Wed, 08 May 2024 12:50:15 GMT
                                                                        • 204.79.197.200:443
                                                                          https://tse1.mm.bing.net/th?id=OADD2.10239351691770_1IUJHOACLFVRNOEKH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                                                                          tls, http2
                                                                          122.0kB
                                                                           3.6MB
                                                                           2610
                                                                          2605

                                                                          HTTP Request

                                                                          GET https://tse1.mm.bing.net/th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

                                                                          HTTP Request

                                                                          GET https://tse1.mm.bing.net/th?id=OADD2.10239351691769_17S178H4I11J3APXJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

                                                                          HTTP Request

                                                                          GET https://tse1.mm.bing.net/th?id=OADD2.10239360931612_153L2SVWUYAQUME4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

                                                                          HTTP Request

                                                                          GET https://tse1.mm.bing.net/th?id=OADD2.10239360931611_1SOG5TNNJKE1WH1R0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

                                                                          HTTP Request

                                                                          GET https://tse1.mm.bing.net/th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

                                                                          HTTP Response

                                                                          200

                                                                          HTTP Response

                                                                          200

                                                                          HTTP Response

                                                                          200

                                                                          HTTP Response

                                                                          200

                                                                          HTTP Response

                                                                          200

                                                                          HTTP Request

                                                                          GET https://tse1.mm.bing.net/th?id=OADD2.10239351691770_1IUJHOACLFVRNOEKH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

                                                                          HTTP Response

                                                                          200
                                                                        • 204.79.197.200:443
                                                                          tse1.mm.bing.net
                                                                          tls, http2
                                                                          1.2kB
                                                                           8.1kB
                                                                           16
                                                                          13
                                                                        • 204.79.197.200:443
                                                                          tse1.mm.bing.net
                                                                          tls, http2
                                                                          1.2kB
                                                                           8.1kB
                                                                           16
                                                                          14
                                                                        • 204.79.197.200:443
                                                                          tse1.mm.bing.net
                                                                          tls, http2
                                                                          1.2kB
                                                                           8.1kB
                                                                           16
                                                                          14
                                                                        • 204.79.197.200:443
                                                                          tse1.mm.bing.net
                                                                          tls, http2
                                                                          1.2kB
                                                                           8.1kB
                                                                           16
                                                                          14
                                                                        • 8.8.8.8:53
                                                                          104.219.191.52.in-addr.arpa
                                                                          dns
                                                                          73 B
                                                                           147 B
                                                                           1
                                                                          1

                                                                          DNS Request

                                                                          104.219.191.52.in-addr.arpa

                                                                        • 8.8.8.8:53
                                                                          249.197.17.2.in-addr.arpa
                                                                          dns
                                                                          71 B
                                                                           135 B
                                                                           1
                                                                          1

                                                                          DNS Request

                                                                          249.197.17.2.in-addr.arpa

                                                                        • 8.8.8.8:53
                                                                          73.31.126.40.in-addr.arpa
                                                                          dns
                                                                          71 B
                                                                           157 B
                                                                           1
                                                                          1

                                                                          DNS Request

                                                                          73.31.126.40.in-addr.arpa

                                                                        • 8.8.8.8:53
                                                                          55.36.223.20.in-addr.arpa
                                                                          dns
                                                                          71 B
                                                                           157 B
                                                                           1
                                                                          1

                                                                          DNS Request

                                                                          55.36.223.20.in-addr.arpa

                                                                        • 8.8.8.8:53
                                                                          183.142.211.20.in-addr.arpa
                                                                          dns
                                                                          73 B
                                                                           159 B
                                                                           1
                                                                          1

                                                                          DNS Request

                                                                          183.142.211.20.in-addr.arpa

                                                                        • 8.8.8.8:53
                                                                          157.123.68.40.in-addr.arpa
                                                                          dns
                                                                          72 B
                                                                           146 B
                                                                           1
                                                                          1

                                                                          DNS Request

                                                                          157.123.68.40.in-addr.arpa

                                                                        • 8.8.8.8:53
                                                                          56.126.166.20.in-addr.arpa
                                                                          dns
                                                                          72 B
                                                                           158 B
                                                                           1
                                                                          1

                                                                          DNS Request

                                                                          56.126.166.20.in-addr.arpa

                                                                        • 8.8.8.8:53
                                                                          17.143.109.104.in-addr.arpa
                                                                          dns
                                                                          73 B
                                                                           139 B
                                                                           1
                                                                          1

                                                                          DNS Request

                                                                          17.143.109.104.in-addr.arpa

                                                                        • 8.8.8.8:53
                                                                          58.99.105.20.in-addr.arpa
                                                                          dns
                                                                          71 B
                                                                           157 B
                                                                           1
                                                                          1

                                                                          DNS Request

                                                                          58.99.105.20.in-addr.arpa

                                                                        • 8.8.8.8:53
                                                                          48.251.17.2.in-addr.arpa
                                                                          dns
                                                                          70 B
                                                                           133 B
                                                                           1
                                                                          1

                                                                          DNS Request

                                                                          48.251.17.2.in-addr.arpa

                                                                        • 8.8.8.8:53
                                                                          43.229.111.52.in-addr.arpa
                                                                          dns
                                                                          72 B
                                                                           158 B
                                                                           1
                                                                          1

                                                                          DNS Request

                                                                          43.229.111.52.in-addr.arpa

                                                                        • 8.8.8.8:53
                                                                          43.58.199.20.in-addr.arpa
                                                                          dns
                                                                          71 B
                                                                           157 B
                                                                           1
                                                                          1

                                                                          DNS Request

                                                                          43.58.199.20.in-addr.arpa

                                                                        • 8.8.8.8:53
                                                                          tse1.mm.bing.net
                                                                          dns
                                                                          62 B
                                                                           173 B
                                                                           1
                                                                          1

                                                                          DNS Request

                                                                          tse1.mm.bing.net

                                                                          DNS Response

                                                                          204.79.197.200
                                                                          13.107.21.200

                                                                        MITRE ATT&CK Enterprise v15

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\Windows\Parameters.ini
                                                                          Filesize

                                                                          74B

                                                                          MD5

                                                                          6687785d6a31cdf9a5f80acb3abc459b

                                                                          SHA1

                                                                          1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                                                          SHA256

                                                                          3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                                                          SHA512

                                                                          5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                                                          Download Submit

                                                                        • C:\Windows\System\explorer.exe
                                                                          Filesize

                                                                          2.2MB

                                                                          MD5

                                                                          45f301c3be9008ed05760789a1c7a214

                                                                          SHA1

                                                                          4384f8a3ff720de13de448b12951620534901d7e

                                                                          SHA256

                                                                          b532e3a4c306cb80b3185675f251cdc0ca7dfdeee61e70d832a1d119c6382aee

                                                                          SHA512

                                                                          4195553da66a70fe1ef2b064bb310c91d2c21cdabbc41c9c9be378b8760ab1e78dacf77ee698d87825408595ef37e55a898ce0e9a4cd1c9e628d702bff04af04

                                                                          Download Submit

                                                                        • C:\Windows\System\spoolsv.exe
                                                                          Filesize

                                                                          2.2MB

                                                                          MD5

                                                                          a6393a8421a1c06f0c5cacd52a745427

                                                                          SHA1

                                                                          54a716e7696c54f58774e5441233d23e31b1c9e1

                                                                          SHA256

                                                                          81a5e2d6e189335fc9cbc2427f9b3f4d2482913ad655414d71eb5438bfe56815

                                                                          SHA512

                                                                          bf76b201b499d8890434538a86dde2f5520ebb8a0a057563237a8543bcc47e651fce4012505066611e8a5888ce86b8485a2375c3dd5d7ec3353eef98edda5094

                                                                          Download Submit

                                                                        • memory/64-1982-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/472-3686-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/560-2413-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/628-2675-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/672-1355-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/808-1208-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/956-1357-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/968-2854-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/1056-1080-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/1056-1977-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/1208-2196-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/1436-2189-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/1448-3784-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/1448-3675-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/1488-1971-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/1488-2129-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/1596-1981-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/1612-1082-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/1612-2077-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/1676-4540-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/1676-4633-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/1712-4069-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/1732-1209-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/1760-1992-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/1860-85-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/1860-1993-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/1860-90-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/1868-4378-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/1868-4280-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/1904-1732-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/1964-2757-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/2080-2927-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/2080-2736-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/2144-2580-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/2144-2595-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/2328-2384-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/2524-2834-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/2772-2081-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/2784-2565-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/2784-2719-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/2796-1545-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/2944-44-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/2944-46-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/2944-79-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/2944-77-0x0000000000440000-0x0000000000509000-memory.dmp

                                                                          Filesize

                                                                          804KB

                                                                          Download

                                                                        • memory/3096-47-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/3096-0-0x0000000000780000-0x0000000000781000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/3096-43-0x0000000000780000-0x0000000000781000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/3096-41-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/3252-2575-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/3384-2168-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/3408-2402-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/3452-1210-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/3492-874-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/3492-1972-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/3652-1733-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/3740-2178-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/3792-4988-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/3928-1356-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/3992-1731-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/4020-3364-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/4020-3260-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/4056-2664-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/4072-1897-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/4080-4404-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/4140-89-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/4140-873-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/4264-2299-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/4264-2313-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/4276-1081-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/4276-1995-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/4356-3057-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/4356-2964-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/4376-2744-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/4456-1970-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/4472-1898-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/4516-2391-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/4520-2209-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/4536-2079-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/4568-1547-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/4800-3271-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/4820-3984-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/4820-4121-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/4888-1546-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/5108-2846-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/5148-4919-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/5280-4737-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/5288-4743-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/5436-4754-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/5480-4764-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/5520-4979-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/5568-4771-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/5628-4782-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/5628-4785-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/5652-5000-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/5696-4791-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/5696-4796-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/5760-5011-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/5776-4807-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/5828-5019-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/5844-4820-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/5912-4838-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        • memory/5992-5082-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                          Filesize

                                                                          248KB

                                                                          Download

                                                                        We care about your privacy.

                                                                        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.