Overview

overview

10

Static

static

10

dd9b63b058...18.exe

windows7-x64

10

dd9b63b058...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-09-2024 03:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dd9b63b0582641fdd9d609c3d6ac77b2_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    dd9b63b0582641fdd9d609c3d6ac77b2

  • SHA1

    8df5943b5bdca4b7be069096b2728cc55caa6c98

  • SHA256

    e2266469e6fb76a77fced73192e7e9f2c7778b88e7a325d78df66c243d79e020

  • SHA512

    f8981a3a452ba3c1a0802fd8519395d947f33d41bc3526b6c46ff31e4623f6a4a18a665f92c4670df97520718edfd7806631adc58fabd80ca65e8ed59cfdc48f

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZm:0UzeyQMS4DqodCnoe+iitjWwwy

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 53 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dd9b63b0582641fdd9d609c3d6ac77b2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dd9b63b0582641fdd9d609c3d6ac77b2_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:5084
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:740
      • C:\Users\Admin\AppData\Local\Temp\dd9b63b0582641fdd9d609c3d6ac77b2_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\dd9b63b0582641fdd9d609c3d6ac77b2_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4668
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:320
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2284
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3284
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2696
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1824
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:1724
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2992
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2464
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1548
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5064
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4356
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2788
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4544
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3964
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:2620
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3688
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:1680
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1484
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:2004
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:4568
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:2280
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2364
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3076
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2288
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1800
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2452
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4932
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3408
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2024
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3524
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:8
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:2908
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:2468
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4840
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2384
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2720
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2640
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3660
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2400
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1300
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:60
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1424
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1404
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3504
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:4512
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:3424
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2264
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3828
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3464
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4756
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3468
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4800
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1364
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3596
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4596
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1308
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4976
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4100
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:2336
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:3244
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1256
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4092
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2244
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2188
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2736
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:2700
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4760
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:2200
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:3444
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:1160
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1496
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:536
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4104
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:1780
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:2976
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                          PID:2036
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:1384
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:1804
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:716
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                            PID:4900
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      PID:4308
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                          PID:3776
                          • \??\c:\windows\system\explorer.exe
                            c:\windows\system\explorer.exe
                            7⤵
                            • Drops file in Windows directory
                            PID:1060
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:3944
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                            PID:1224
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              7⤵
                              • Drops file in Windows directory
                              PID:1116
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:4540
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:2888
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              7⤵
                              • Drops file in Windows directory
                              PID:1488
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          PID:2676
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:2712
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              7⤵
                              • Drops file in Windows directory
                              PID:1884
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:4736
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:1528
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            PID:4500
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:1252
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Suspicious use of SetThreadContext
                              PID:3640
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                  PID:2936
                                  • \??\c:\windows\system\explorer.exe
                                    c:\windows\system\explorer.exe
                                    7⤵
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    PID:920
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                PID:3868
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                    PID:3484
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      7⤵
                                      • Drops file in Windows directory
                                      PID:1512
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  PID:2928
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:808
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Suspicious use of SetThreadContext
                                  • System Location Discovery: System Language Discovery
                                  PID:2840
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:5012
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  PID:3356
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3596
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  PID:4940
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:864
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      7⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:916
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Drops file in Windows directory
                                  PID:3000
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                      PID:1324
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    PID:4452
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1164
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                      PID:1088
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                        PID:3564
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        PID:964
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        PID:2348
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Drops file in Windows directory
                                        PID:3372
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Drops file in Windows directory
                                        PID:5112
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        PID:4872
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3404
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1032
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Drops file in Windows directory
                                        PID:1312
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                          PID:5100
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          • System Location Discovery: System Language Discovery
                                          PID:4340
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          • System Location Discovery: System Language Discovery
                                          PID:4588
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:624
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                  1⤵
                                    PID:1428

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Windows\Parameters.ini
                                    Filesize

                                    74B

                                    MD5

                                    6687785d6a31cdf9a5f80acb3abc459b

                                    SHA1

                                    1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                    SHA256

                                    3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                    SHA512

                                    5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                    Download Submit

                                  • C:\Windows\System\explorer.exe
                                    Filesize

                                    2.2MB

                                    MD5

                                    12aa7e7c81dd1c2be1049f8ea035855c

                                    SHA1

                                    a87dc98cf32c3fa06af102fac40e275bd6489e4c

                                    SHA256

                                    176789bc5d7034a07e204e149ed5e460c72e3bde996cf2960c66e8bd99c4fa0d

                                    SHA512

                                    5156f89bdfa70e657298e1d60b0f11fec63cfc6cf8c3881d76583bfdd81be0bc81e0b050ceab83a21490399a3962cb9f3137fe2a6fcbaa8b7bedda6dbce10154

                                    Download Submit

                                  • C:\Windows\System\spoolsv.exe
                                    Filesize

                                    2.2MB

                                    MD5

                                    c8ecee380d3007feec59fcd4cddfac8b

                                    SHA1

                                    7df13b778f75ca5909a8517d91a40ae48696ab7a

                                    SHA256

                                    92e576c89241b7790cd247ead88bbec10ed018d37677634de2b21874eb6bf4fb

                                    SHA512

                                    9f99daf30b440ffa6f49922cf4eaabdbedbada919db771f4cc07841564566abfc4f64b8ce0e2f747419f60859947c47d6360e1a849f85d6091b68946386a8b57

                                    Download Submit

                                  • memory/60-1862-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/320-109-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/320-104-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/536-3003-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/864-5088-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1160-4637-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1224-4096-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1252-4671-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1308-2681-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1324-5109-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1324-5106-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1364-2038-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/1404-1929-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/1424-2483-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1484-2197-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1484-2286-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1528-4626-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1548-2041-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/1548-1076-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/1680-1250-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/1724-3265-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1780-3214-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1780-3339-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1800-1415-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/1804-3593-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2024-1612-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/2036-4989-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2188-2838-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2200-3077-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2200-2921-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2264-2011-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/2280-1301-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/2284-3909-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2284-730-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2284-108-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2288-2219-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2288-2215-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2364-2205-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2384-1676-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/2400-1805-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/2452-2231-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2452-2226-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2464-2029-0x0000000000440000-0x0000000000509000-memory.dmp

                                    Filesize

                                    804KB

                                    Download

                                  • memory/2464-2028-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2468-1613-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/2620-1204-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/2640-1748-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/2696-2128-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2696-2019-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2700-2844-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2712-4615-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2712-4767-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2720-2361-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2788-2054-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2788-2050-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2888-4488-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2908-3811-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2936-4890-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2992-1000-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/2992-2030-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/3076-1352-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/3244-4526-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3284-2020-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/3284-807-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/3408-2239-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3408-2242-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3424-4227-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3464-2018-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/3468-2027-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/3484-5057-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3484-4973-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3504-2551-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3504-2730-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3524-2532-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3524-2339-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3596-5009-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3596-2667-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3596-2670-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3660-2368-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3688-2075-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3776-3799-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3828-2560-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3828-2558-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3964-2063-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4092-2764-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4092-2761-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4100-2752-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4356-2051-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/4356-1077-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/4544-1148-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/4568-3500-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4596-2048-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/4668-50-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4668-98-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4668-51-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4800-2659-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4900-5098-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4932-1506-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/5012-4996-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/5064-2040-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/5084-56-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/5084-0-0x0000000002370000-0x0000000002371000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/5084-47-0x0000000002370000-0x0000000002371000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/5084-46-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download