Overview

overview

10

Static

static

10

dbe5639ea6...18.exe

windows7-x64

10

dbe5639ea6...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-09-2024 05:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dbe5639ea62bc77b841cb137679079a6_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    dbe5639ea62bc77b841cb137679079a6

  • SHA1

    21188b5c3e40d6fa728b4d53f8271b53e8837c39

  • SHA256

    80f2e45cd4a3ee117adc5292e63e1f697ed6d3e33e7fc08671adfc58ba227946

  • SHA512

    ba1b59f6f8f3d8743aebb4f4eb1c5cc61dde28d8b97942a91d2463b44b3cec4f28e320bbf2a326919d1f4c9c095e9f0fd7ae61ab0353749759f7532959447fb7

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ1:0UzeyQMS4DqodCnoe+iitjWww5

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 55 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dbe5639ea62bc77b841cb137679079a6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dbe5639ea62bc77b841cb137679079a6_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:720
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:4856
      • C:\Users\Admin\AppData\Local\Temp\dbe5639ea62bc77b841cb137679079a6_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\dbe5639ea62bc77b841cb137679079a6_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3348
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4964
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3828
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:3056
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3240
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2520
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:5088
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1916
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1164
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:3940
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:5012
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4076
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3956
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1532
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4568
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4708
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:4440
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1196
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4908
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2756
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4916
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3624
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:440
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:5096
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3328
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1740
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2436
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2392
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1684
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4676
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2788
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:1088
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:3284
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3852
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4964
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:432
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4992
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1552
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:552
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4396
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3120
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:3312
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:764
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:2288
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2832
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3372
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:952
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3384
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1904
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:4156
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:3900
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1756
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2828
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:3884
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:2352
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3088
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4764
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:8
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:3980
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3804
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1848
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:2128
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:2456
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:1008
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4984
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Suspicious use of SetThreadContext
                      PID:4916
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:3672
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1328
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:5076
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:1920
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1456
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3568
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2492
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:856
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:1600
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:5080
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                          PID:2548
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:1796
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:3528
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:4212
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                            PID:3416
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:1880
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                          PID:3452
                          • \??\c:\windows\system\explorer.exe
                            c:\windows\system\explorer.exe
                            7⤵
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:4876
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:4288
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                            PID:3560
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              7⤵
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:4384
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:2592
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:4508
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Drops file in Windows directory
                                PID:3600
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:512
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:3048
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Drops file in Windows directory
                                PID:4040
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:944
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:1868
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:4300
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            PID:3388
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:4436
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:4780
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:736
                                • \??\c:\windows\system\explorer.exe
                                  c:\windows\system\explorer.exe
                                  7⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4252
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Suspicious use of SetThreadContext
                              • Drops file in Windows directory
                              PID:4080
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                  PID:116
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                PID:4148
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                    PID:864
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Suspicious use of SetThreadContext
                                  PID:4792
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3460
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  PID:3060
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:4400
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  PID:532
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3976
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      7⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1824
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  PID:1948
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                      PID:3428
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Suspicious use of SetThreadContext
                                    • Drops file in Windows directory
                                    PID:468
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1768
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    PID:5020
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:5060
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Drops file in Windows directory
                                    PID:3844
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    PID:4348
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Drops file in Windows directory
                                    PID:1776
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                      PID:3660
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:664
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2528
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:3024
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:780
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:4484
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Drops file in Windows directory
                                      PID:4952
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1536
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:3576
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:4896
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1736
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                              1⤵
                                PID:3228

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Windows\Parameters.ini
                                Filesize

                                74B

                                MD5

                                6687785d6a31cdf9a5f80acb3abc459b

                                SHA1

                                1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                SHA256

                                3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                SHA512

                                5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                Download Submit

                              • C:\Windows\System\explorer.exe
                                Filesize

                                2.2MB

                                MD5

                                aa3bfbc10dff50542448bb1854c3698d

                                SHA1

                                6e63cf613ffb67c611d86566cfeb834c18340a0a

                                SHA256

                                888cfc32321a24aaa01f7c1a0812510f4fe1c09667593468da9dea4b948bda34

                                SHA512

                                f2f2aabc9ba7d8c2a66d40966a1bacfc79fab2e0cf992146d98b0862581c5a6bc5297dbccea868e391416c10dca397c3445d066d46370bce50b5619b64bc91ce

                                Download Submit

                              • C:\Windows\System\spoolsv.exe
                                Filesize

                                2.2MB

                                MD5

                                7562fca758702fa0f3fdeeb64d375a82

                                SHA1

                                47968c10274d16b0577fac00ae82a268406e372c

                                SHA256

                                8586d09443e5dc9197c935fcf1d1d6808dd7676434abd1465d31c02e8bfe83ef

                                SHA512

                                2155e259130292eb4d0180940ad30ac6f2ebb8e3f2a9a372ec2dae5d66bce31926dd1b0393c13da9631223a7482975aaa6c453e08d50b26951592cb6f5083e86

                                Download Submit

                              • memory/8-2046-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/116-5150-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/116-5145-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/432-1638-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/440-2233-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/440-2229-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/552-2543-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/552-2539-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/720-0-0x0000000000790000-0x0000000000791000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/720-23-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/720-17-0x0000000000790000-0x0000000000791000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/720-16-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/736-5129-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/764-4298-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/864-5232-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/864-5228-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/952-2640-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/952-2636-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/1164-2024-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/1196-1106-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/1456-3090-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/1532-1100-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/1552-1711-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/1600-3313-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/1684-2333-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/1740-1381-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/1756-2034-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/1768-5401-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/1848-2905-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/1868-4835-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/1868-4975-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/1904-2726-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/1904-2722-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/1916-2026-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/1916-887-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/2288-1779-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/2352-4638-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/2392-1453-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/2436-2278-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/2436-2261-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/2456-2912-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/2456-2917-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/2492-3160-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/2548-5140-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/2756-1152-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/2788-2581-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/2828-2805-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/2828-2984-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/2832-2627-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3048-4756-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3048-4644-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3056-2016-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/3056-764-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/3088-2045-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/3120-2787-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3120-2619-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3240-2166-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3240-2015-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3284-4023-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3328-2244-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3348-20-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3348-21-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3348-50-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3348-48-0x0000000000440000-0x0000000000509000-memory.dmp

                                Filesize

                                804KB

                                Download

                              • memory/3372-1856-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/3384-1953-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/3416-5382-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3428-5390-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3452-3926-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3460-5245-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3460-5241-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3528-3650-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3528-3776-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3560-4181-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3560-4268-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3624-1223-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/3672-4847-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3828-692-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3828-4179-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3828-65-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3852-1571-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/3900-2734-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3940-953-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/3940-2037-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/3956-2047-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3976-5369-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/3980-2893-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/4076-1014-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/4156-2023-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/4396-1778-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/4436-4917-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/4440-3739-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/4508-4546-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/4568-2199-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/4568-2417-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/4676-1499-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/4764-2815-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/4908-2207-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/4908-2211-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/4916-2219-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/4964-2443-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/4964-66-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/4964-61-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download

                              • memory/4984-3222-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/4984-3070-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/4992-2455-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/5012-2035-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/5076-3081-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/5088-3323-0x0000000000400000-0x000000000043E000-memory.dmp

                                Filesize

                                248KB

                                Download

                              • memory/5096-1299-0x0000000000400000-0x00000000005D3000-memory.dmp

                                Filesize

                                1.8MB

                                Download