Overview

overview

10

Static

static

10

f179cad90b...18.exe

windows7-x64

10

f179cad90b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-09-2024 06:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f179cad90b0c7a88031cd986f6cdb0c3_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    f179cad90b0c7a88031cd986f6cdb0c3

  • SHA1

    fda35fcc53601226b7481f272cb323ae0eeb7af2

  • SHA256

    4c0b6f5bc66e2a6ef88026bd138392f11b8d17c19864388063108d4984d8fffb

  • SHA512

    f498f74b25e5312ab12bcade0242205ac23f86d0a82ff988614d2b1fbf43325cb655c35abc1e47e32e8705ac9a383a1df93b04d6b5e60ac3fdfa5f8d1311999c

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ8:0UzeyQMS4DqodCnoe+iitjWwwA

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 60 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f179cad90b0c7a88031cd986f6cdb0c3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f179cad90b0c7a88031cd986f6cdb0c3_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1580
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:3604
      • C:\Users\Admin\AppData\Local\Temp\f179cad90b0c7a88031cd986f6cdb0c3_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\f179cad90b0c7a88031cd986f6cdb0c3_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4472
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4028
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2216
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2844
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2360
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4716
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:4776
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4864
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2636
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2744
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2368
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:2976
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:744
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2160
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1048
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2660
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:608
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2032
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1728
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:4860
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:4120
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1360
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4376
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:4144
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2112
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:3376
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3452
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2684
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1464
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2204
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3644
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:4264
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2696
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:4492
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4340
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3980
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2340
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:2616
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:2104
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:4584
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2928
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1780
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2428
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3192
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3780
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3948
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1304
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1532
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:448
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:2268
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:216
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:2276
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:1936
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4288
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:1944
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:2812
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:2364
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:5104
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:4368
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:2468
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4960
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3968
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:3648
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Suspicious use of SetThreadContext
                      PID:4252
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                          PID:2436
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:3244
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:2516
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:4128
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:3736
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4872
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:4208
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:2892
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:4616
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:5096
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                            PID:2112
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:1056
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                          PID:1084
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:1656
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                            PID:4044
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:4804
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:4656
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:3840
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:4152
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Suspicious use of SetThreadContext
                                PID:4344
                                • \??\c:\windows\system\explorer.exe
                                  "c:\windows\system\explorer.exe"
                                  8⤵
                                    PID:916
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Drops file in Windows directory
                              PID:3128
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:680
                                • \??\c:\windows\system\explorer.exe
                                  c:\windows\system\explorer.exe
                                  7⤵
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  PID:4600
                                  • \??\c:\windows\system\explorer.exe
                                    "c:\windows\system\explorer.exe"
                                    8⤵
                                      PID:884
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:5080
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                    PID:4052
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      7⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:1308
                                      • \??\c:\windows\system\explorer.exe
                                        "c:\windows\system\explorer.exe"
                                        8⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3700
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  PID:712
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3012
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      7⤵
                                      • Drops file in Windows directory
                                      PID:1092
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • System Location Discovery: System Language Discovery
                                  PID:3112
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:888
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      7⤵
                                      • Drops file in Windows directory
                                      PID:4236
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  PID:4360
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:936
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      7⤵
                                        PID:2880
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Suspicious use of SetThreadContext
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    PID:536
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                        PID:2304
                                        • \??\c:\windows\system\explorer.exe
                                          c:\windows\system\explorer.exe
                                          7⤵
                                          • Drops file in Windows directory
                                          • System Location Discovery: System Language Discovery
                                          PID:3360
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      PID:2640
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3544
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Suspicious use of SetThreadContext
                                      PID:832
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3396
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:640
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                          PID:412
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Suspicious use of SetThreadContext
                                        PID:3136
                                        • \??\c:\windows\system\spoolsv.exe
                                          "c:\windows\system\spoolsv.exe"
                                          6⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2156
                                          • \??\c:\windows\system\explorer.exe
                                            c:\windows\system\explorer.exe
                                            7⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:652
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Suspicious use of SetThreadContext
                                        • Drops file in Windows directory
                                        PID:3904
                                        • \??\c:\windows\system\spoolsv.exe
                                          "c:\windows\system\spoolsv.exe"
                                          6⤵
                                            PID:3824
                                            • \??\c:\windows\system\explorer.exe
                                              c:\windows\system\explorer.exe
                                              7⤵
                                              • Drops file in Windows directory
                                              PID:1992
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Suspicious use of SetThreadContext
                                          • Drops file in Windows directory
                                          PID:2380
                                          • \??\c:\windows\system\spoolsv.exe
                                            "c:\windows\system\spoolsv.exe"
                                            6⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:3732
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Suspicious use of SetThreadContext
                                          • System Location Discovery: System Language Discovery
                                          PID:2480
                                          • \??\c:\windows\system\spoolsv.exe
                                            "c:\windows\system\spoolsv.exe"
                                            6⤵
                                              PID:1888
                                              • \??\c:\windows\system\explorer.exe
                                                c:\windows\system\explorer.exe
                                                7⤵
                                                • Drops file in Windows directory
                                                PID:1832
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                            • Suspicious use of SetThreadContext
                                            • System Location Discovery: System Language Discovery
                                            PID:4764
                                            • \??\c:\windows\system\spoolsv.exe
                                              "c:\windows\system\spoolsv.exe"
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:980
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                            • Suspicious use of SetThreadContext
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            PID:4232
                                            • \??\c:\windows\system\spoolsv.exe
                                              "c:\windows\system\spoolsv.exe"
                                              6⤵
                                                PID:2164
                                                • \??\c:\windows\system\explorer.exe
                                                  c:\windows\system\explorer.exe
                                                  7⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3952
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Drops file in Windows directory
                                              • System Location Discovery: System Language Discovery
                                              PID:1104
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Drops file in Windows directory
                                              PID:2828
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3916
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Drops file in Windows directory
                                              PID:1400
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:4848
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Drops file in Windows directory
                                              • System Location Discovery: System Language Discovery
                                              PID:2136
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Drops file in Windows directory
                                              PID:3352
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Drops file in Windows directory
                                              • System Location Discovery: System Language Discovery
                                              PID:4624
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Drops file in Windows directory
                                              PID:4748
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Drops file in Windows directory
                                              • System Location Discovery: System Language Discovery
                                              PID:3636
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Drops file in Windows directory
                                              PID:4304
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Drops file in Windows directory
                                              PID:4908
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Drops file in Windows directory
                                              • System Location Discovery: System Language Discovery
                                              PID:2912
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Drops file in Windows directory
                                              PID:2832
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                                PID:3188
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:4420
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                  PID:3472
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                          1⤵
                                            PID:1584

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Windows\Parameters.ini
                                            Filesize

                                            74B

                                            MD5

                                            6687785d6a31cdf9a5f80acb3abc459b

                                            SHA1

                                            1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                            SHA256

                                            3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                            SHA512

                                            5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                            Download Submit

                                          • C:\Windows\System\explorer.exe
                                            Filesize

                                            2.2MB

                                            MD5

                                            19cd137b18329d827e485b5457922d88

                                            SHA1

                                            fb3f6e56a5c47873cbf5e6d7c44369e99d3cc859

                                            SHA256

                                            be752939d78cc8d85e455f6feb5e1db6231d99fcb3c77ba4c876dd4a290d16ae

                                            SHA512

                                            bcb8a5ae22c4fee5c492c252f21afe3921ff79b4ca4ab717faf2c341137125ece34cc5845fae0fa7721fc40a21dea29009e4d22ddc0acd2bcbd02d1f0f388b5a

                                            Download Submit

                                          • C:\Windows\System\spoolsv.exe
                                            Filesize

                                            2.2MB

                                            MD5

                                            877c6351bbfa4312f86bd975088132f6

                                            SHA1

                                            d89dbccd574916f586af4517126fae2f2c6ce03a

                                            SHA256

                                            b51afeb8a9972733d65335a4d1c938c2840c36f76b38e8c396e72a85f0bc6237

                                            SHA512

                                            74a390a011d0964b6cc5dc593d9beed4333b1df402b4d9450c5231b129f98dabbc695889ba944eacdf4af66f0530a7f07c9d9f277124bc2138577dfd71565604

                                            Download Submit

                                          • memory/216-2919-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/448-2856-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/608-2353-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/680-3748-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/744-2331-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/884-5414-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/916-5118-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/936-4991-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/980-5607-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/1048-2342-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/1304-2737-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/1304-2732-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/1360-1347-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/1464-2503-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/1532-2167-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/1580-33-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/1580-26-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/1580-0-0x0000000000700000-0x0000000000701000-memory.dmp

                                            Filesize

                                            4KB

                                            Download

                                          • memory/1580-27-0x0000000000700000-0x0000000000701000-memory.dmp

                                            Filesize

                                            4KB

                                            Download

                                          • memory/1728-2451-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/1728-2596-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/1780-1961-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/1888-5520-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/1936-4615-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/1944-2926-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2032-1276-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/2104-4243-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2112-2482-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2112-5099-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2156-5388-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2160-1215-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/2204-1627-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/2216-4226-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2216-65-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2216-795-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2268-2229-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/2304-5089-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2340-2694-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2340-2863-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2360-2443-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2364-2936-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2368-2319-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2428-2715-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2428-2713-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2436-4877-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2468-2318-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/2516-3091-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2516-3095-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2636-2307-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2660-1275-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/2684-1560-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/2696-2525-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2744-1043-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/2744-2321-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/2812-2293-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/2844-861-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/2844-2298-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/2928-2704-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/2976-1099-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/3192-2099-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/3376-1555-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/3396-5125-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/3452-2494-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/3544-5109-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/3644-2514-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/3648-3070-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/3648-3151-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/3700-5673-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/3736-3103-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/3736-3107-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/3780-2724-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/3824-5404-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/3948-2100-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/3980-1827-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/4028-60-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/4028-66-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/4044-3272-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/4044-3267-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/4052-4161-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/4120-4092-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/4144-1473-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/4152-3409-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/4152-3508-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/4264-1724-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/4288-2292-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/4340-2537-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/4340-2533-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/4368-2945-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/4376-2470-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/4472-52-0x0000000000440000-0x0000000000509000-memory.dmp

                                            Filesize

                                            804KB

                                            Download

                                          • memory/4472-29-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/4472-30-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/4472-54-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/4492-1826-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/4584-1899-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/4616-3381-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/4616-3163-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/4656-3284-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/4656-3280-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/4776-3760-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/4864-977-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/4864-2309-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download

                                          • memory/4960-2953-0x0000000000400000-0x000000000043E000-memory.dmp

                                            Filesize

                                            248KB

                                            Download

                                          • memory/5104-2306-0x0000000000400000-0x00000000005D3000-memory.dmp

                                            Filesize

                                            1.8MB

                                            Download