Overview

overview

10

Static

static

10

ee0af89c55...18.exe

windows7-x64

10

ee0af89c55...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-09-2024 17:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ee0af89c5544c4337b90c02377fc9df7_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    ee0af89c5544c4337b90c02377fc9df7

  • SHA1

    cee5122d5326b5e520c6696088c34c904f059b2e

  • SHA256

    dbf531ebbe37e385396e1ba5d18231e2e20a57bbebdfdc0e5139bf9335f92c57

  • SHA512

    45d8f81f3ef5aa51b7a5c8c6b303938f1925944dc67d9c0b252ff6bd82b1a1754f5166ae335ecba92c7dd4c2032f7e55ed8844517eecbe760afadb07ea7e270f

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZp:0UzeyQMS4DqodCnoe+iitjWww1

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 53 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee0af89c5544c4337b90c02377fc9df7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ee0af89c5544c4337b90c02377fc9df7_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3428
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:3480
      • C:\Users\Admin\AppData\Local\Temp\ee0af89c5544c4337b90c02377fc9df7_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\ee0af89c5544c4337b90c02377fc9df7_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4552
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3424
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2112
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:4220
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:5104
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1580
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:3780
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2248
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2280
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4624
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1852
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2180
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3940
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:4764
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1960
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:4028
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2612
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1828
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:2616
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:3636
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4044
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2268
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4784
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:4144
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2096
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:456
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:2440
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:3916
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2780
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4644
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4676
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:3368
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:324
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1456
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4556
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    PID:1424
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:4340
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:4696
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:748
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4168
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3948
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:228
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1556
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1448
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3840
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:2220
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4880
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      PID:4924
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                          PID:2064
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4560
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1476
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:2856
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:3324
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:2992
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:3208
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:2664
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                          • System Location Discovery: System Language Discovery
                          PID:4060
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4948
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:972
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:2444
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:3020
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:4532
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:2844
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:2632
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:3884
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4376
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:3592
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:3528
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                            PID:1076
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:1972
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:3108
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:3580
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:2960
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:4392
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:2956
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:4500
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                          PID:3460
                          • \??\c:\windows\system\explorer.exe
                            c:\windows\system\explorer.exe
                            7⤵
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:2152
                            • \??\c:\windows\system\explorer.exe
                              "c:\windows\system\explorer.exe"
                              8⤵
                                PID:2372
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:4508
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:4920
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              7⤵
                              • Suspicious use of SetThreadContext
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:4012
                              • \??\c:\windows\system\explorer.exe
                                "c:\windows\system\explorer.exe"
                                8⤵
                                  PID:428
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:3040
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:1096
                                • \??\c:\windows\system\explorer.exe
                                  c:\windows\system\explorer.exe
                                  7⤵
                                  • Drops file in Windows directory
                                  PID:4036
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Drops file in Windows directory
                              PID:1360
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                  PID:4600
                                  • \??\c:\windows\system\explorer.exe
                                    c:\windows\system\explorer.exe
                                    7⤵
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    PID:1008
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:4956
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                    PID:2484
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      7⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4704
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  PID:4636
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                      PID:4112
                                      • \??\c:\windows\system\explorer.exe
                                        c:\windows\system\explorer.exe
                                        7⤵
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        PID:216
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Suspicious use of SetThreadContext
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    PID:2040
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:5044
                                      • \??\c:\windows\system\explorer.exe
                                        c:\windows\system\explorer.exe
                                        7⤵
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        PID:1292
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Suspicious use of SetThreadContext
                                    • Drops file in Windows directory
                                    PID:4388
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2296
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Suspicious use of SetThreadContext
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    PID:4592
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4896
                                      • \??\c:\windows\system\explorer.exe
                                        c:\windows\system\explorer.exe
                                        7⤵
                                        • Drops file in Windows directory
                                        PID:2084
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Suspicious use of SetThreadContext
                                    • Drops file in Windows directory
                                    PID:5076
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                        PID:220
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      PID:1068
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1800
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:1992
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3608
                                        • \??\c:\windows\system\explorer.exe
                                          c:\windows\system\explorer.exe
                                          7⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1944
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:3980
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                          PID:4628
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Drops file in Windows directory
                                        PID:3628
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:408
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Drops file in Windows directory
                                        PID:1000
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Drops file in Windows directory
                                        PID:1548
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Drops file in Windows directory
                                        PID:4928
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        PID:1556
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Drops file in Windows directory
                                        PID:2676
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Drops file in Windows directory
                                        PID:2140
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4800
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                          PID:2964
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          PID:4748
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:4400
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          • System Location Discovery: System Language Discovery
                                          PID:1560
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          PID:3620
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          PID:2800
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:728
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                  1⤵
                                    PID:1572

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Windows\Parameters.ini
                                    Filesize

                                    74B

                                    MD5

                                    6687785d6a31cdf9a5f80acb3abc459b

                                    SHA1

                                    1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                    SHA256

                                    3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                    SHA512

                                    5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                    Download Submit

                                  • C:\Windows\System\explorer.exe
                                    Filesize

                                    2.2MB

                                    MD5

                                    3b5b80622caa6bc9b00d48c0e669d7f2

                                    SHA1

                                    fdf617a4a7cfda3bd60b9a2769930312f09f3d0f

                                    SHA256

                                    d2a190166c509cea359185280e0dba331a0e726111e601ff35218f597ec9d603

                                    SHA512

                                    3cf8616b8c000d284606fc5eb5229638e0d7a11627a82c996245bab71845c68ea8309d3271300c498d757fe4f4ce4dc62049a6028522b390b39990e8362f125e

                                    Download Submit

                                  • C:\Windows\System\spoolsv.exe
                                    Filesize

                                    2.2MB

                                    MD5

                                    5b9b324c54ce8b043ccc57e2ec0ad2b8

                                    SHA1

                                    1e5837ce61a481ebd93e87052c1f7933ccd3dcf5

                                    SHA256

                                    32a24677f1cf7873926a1de32866c88732e347a95c51b64e7ea28af2ebf7b493

                                    SHA512

                                    bf4315247c93438b28b7e1b38cb3e2b67400fc4bd8b2eaaa6785937f439fb03a484c08b8c19b64f6c2b29e67fabcb89388800851c750101a6152336f49d54bbd

                                    Download Submit

                                  • memory/228-1727-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/324-2446-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/428-5047-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/748-2540-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/748-2536-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/972-2873-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1076-4688-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1096-3834-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1096-3705-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1448-1799-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/1456-1546-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/1476-2718-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1476-2720-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1800-4910-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1800-4913-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1852-1947-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/1960-2065-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2064-4117-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2096-2495-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2096-2352-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2112-3896-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2112-91-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2112-660-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2180-969-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/2220-1902-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/2248-1934-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/2248-842-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/2268-1288-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/2280-1936-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2296-4760-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2372-4853-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2440-3796-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2444-2047-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/2484-4110-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2612-2158-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2612-2334-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2616-3572-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2844-2897-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2856-1928-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/2956-3151-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/2992-1946-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/3020-2885-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3108-3054-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3108-3057-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3208-2866-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3208-3025-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3324-2729-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3368-1499-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/3424-90-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/3424-85-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/3428-34-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/3428-27-0x0000000002370000-0x0000000002371000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/3428-0-0x0000000002370000-0x0000000002371000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/3428-26-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/3460-3427-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3460-3313-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3592-3163-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3592-3047-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3608-5037-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3608-5176-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3636-1202-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/3780-3447-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3840-2647-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3884-2972-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3884-2969-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3916-1351-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/3940-2056-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3948-2552-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/3948-2547-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4028-1121-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/4044-2168-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4060-4490-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4060-4495-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4112-4421-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4112-4538-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4144-1289-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/4168-1680-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/4220-739-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/4220-1925-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/4340-3980-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4552-30-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4552-72-0x0000000000440000-0x0000000000509000-memory.dmp

                                    Filesize

                                    804KB

                                    Download

                                  • memory/4552-29-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4552-74-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4556-2528-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4560-1903-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/4600-3902-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4600-4027-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4624-908-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/4624-1949-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/4628-5059-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4644-1428-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/4676-2370-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4696-1598-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/4764-1040-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/4784-2258-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4880-2784-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4880-2710-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4896-4831-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4896-4962-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4920-3506-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4920-3635-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/4948-2046-0x0000000000400000-0x00000000005D3000-memory.dmp

                                    Filesize

                                    1.8MB

                                    Download

                                  • memory/5044-4677-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/5104-1924-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download

                                  • memory/5104-2140-0x0000000000400000-0x000000000043E000-memory.dmp

                                    Filesize

                                    248KB

                                    Download