Overview

overview

10

Static

static

10

f4809e4759...18.exe

windows7-x64

10

f4809e4759...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-09-2024 21:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f4809e4759cc4f0735c85e929b4527ae_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    f4809e4759cc4f0735c85e929b4527ae

  • SHA1

    eec8570ad4113ab6f620b591604736679fa2d07e

  • SHA256

    677138f056c27d6a8d24abad56d637ab247bc63ed74cfdaadd6a5bcf46ee0857

  • SHA512

    37a3c1554f3c7fed7cc2144594ecb7f870908a2a95baca99014b0b9f1322083f65f03a7e446a953ad406921fd0e879776cc9b2f991544048e74f2a418336c696

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZS:0UzeyQMS4DqodCnoe+iitjWwwm

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 51 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f4809e4759cc4f0735c85e929b4527ae_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f4809e4759cc4f0735c85e929b4527ae_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1652
      • C:\Users\Admin\AppData\Local\Temp\f4809e4759cc4f0735c85e929b4527ae_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\f4809e4759cc4f0735c85e929b4527ae_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3288
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4628
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2888
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3972
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2660
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:2388
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:2140
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4464
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1732
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:5072
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4040
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:2732
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2572
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2076
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4348
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2756
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3900
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4272
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:2336
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:880
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:936
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:4396
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:5040
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3068
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:784
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3420
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3480
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:4884
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:2092
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:2392
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2800
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3380
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:5000
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:5108
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1532
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1008
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1000
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4808
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1600
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4924
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:1984
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:1544
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:64
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3888
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4812
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3708
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4224
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2192
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3108
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:2016
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:4076
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3920
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1660
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:456
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:760
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2952
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4588
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4244
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:1896
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:752
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:1536
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:592
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4252
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:552
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:2840
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4972
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:1416
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:1668
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:1164
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3100
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1508
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:4976
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:4312
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2160
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4628
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Suspicious use of SetThreadContext
                      PID:4232
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:4492
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:3064
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                      PID:2460
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:4012
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                            PID:2968
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:4116
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                          PID:3620
                          • \??\c:\windows\system\explorer.exe
                            c:\windows\system\explorer.exe
                            7⤵
                            • Drops file in Windows directory
                            PID:2156
                            • \??\c:\windows\system\explorer.exe
                              "c:\windows\system\explorer.exe"
                              8⤵
                                PID:1860
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:2372
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:4084
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              7⤵
                              • Drops file in Windows directory
                              PID:1380
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:3336
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:4592
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              7⤵
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:3152
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:940
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:1968
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              7⤵
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:4136
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:1088
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:388
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              7⤵
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:4484
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:4632
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:2032
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              7⤵
                              • Drops file in Windows directory
                              PID:428
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:4756
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:1528
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:2752
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:4156
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Suspicious use of SetThreadContext
                          PID:1312
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:1120
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:3980
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:2612
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              7⤵
                              • System Location Discovery: System Language Discovery
                              PID:4140
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Drops file in Windows directory
                          PID:3048
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:4516
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                  PID:2300
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:2764
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                  PID:4124
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:2492
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                    PID:2020
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      7⤵
                                        PID:1252
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    PID:2204
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                        PID:2516
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2308
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Drops file in Windows directory
                                      PID:5112
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Drops file in Windows directory
                                      PID:1476
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Drops file in Windows directory
                                      PID:812
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:412
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Drops file in Windows directory
                                      PID:4504
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Drops file in Windows directory
                                      PID:4736
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Drops file in Windows directory
                                      PID:3632
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:3520
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                        PID:4512
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                          PID:4900
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                            PID:1220
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                    1⤵
                                      PID:3716

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Windows\Parameters.ini
                                      Filesize

                                      74B

                                      MD5

                                      6687785d6a31cdf9a5f80acb3abc459b

                                      SHA1

                                      1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                      SHA256

                                      3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                      SHA512

                                      5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                      Download Submit

                                    • C:\Windows\System\explorer.exe
                                      Filesize

                                      2.2MB

                                      MD5

                                      9a1dc3b80c983ddb8e5299b54d26e941

                                      SHA1

                                      9ee28ad0c745ff342282d1c5b57aaca06cb0e52e

                                      SHA256

                                      5221cace7ec7cba3a6d31e5d41a5623833a358213f897f58cab85a3b59ff935c

                                      SHA512

                                      f187c9be33a0a8f917ed21951eac6f8b72882323329ca2557e1f395e6a5a285a82987f876eb4bec2716212dc0f86eef3deccbd04207f5fe0ea417f68113520f5

                                      Download Submit

                                    • C:\Windows\System\spoolsv.exe
                                      Filesize

                                      2.2MB

                                      MD5

                                      cbd28117f7d3ec888cad3cfa3ffd7f53

                                      SHA1

                                      bd950bbb35479fd37ac5e1daa867355a08211ef1

                                      SHA256

                                      dbae3a17d3c988a6c0d98b7497195aea00a3ccba204f47d13aaa5189bc837666

                                      SHA512

                                      cbb0d4c3482fa18ecdfa823197fff27d475c0eb5bb1c305079e2bbbe27a3281fe1eac996ede8ee71e5bd876f31c5ea4e709feb4c94479f6a3aa29854b1229a87

                                      Download Submit

                                    • memory/64-2597-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/456-2015-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/760-2790-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/784-2330-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/880-41-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/880-0-0x0000000002370000-0x0000000002371000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/880-1223-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/880-49-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/880-42-0x0000000002370000-0x0000000002371000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/936-2234-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/1000-2503-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/1008-1664-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/1120-4652-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/1164-4546-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/1416-3140-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/1416-3222-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/1508-3149-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/1528-4557-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/1536-4449-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/1544-1789-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/1600-2752-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/1660-2777-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/1660-2780-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/1732-2014-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/1860-4946-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/1896-3124-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/1968-4202-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/1968-4339-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/1984-4006-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2020-5022-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2032-4538-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2032-4700-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2076-1146-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/2092-3896-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2140-3471-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2192-1979-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/2336-3664-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2392-1479-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/2460-3459-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2516-5033-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2572-2041-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2612-4714-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2612-4839-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2660-2207-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2660-2006-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2732-1075-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/2756-1222-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/2800-2396-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2800-2393-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2840-2973-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2840-2977-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2888-726-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2888-111-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2888-3865-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/2952-2021-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/2968-4790-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/3068-1355-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/3108-2769-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/3108-2918-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/3288-45-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/3288-100-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/3288-46-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/3380-1545-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/3420-1407-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/3480-2572-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/3480-2383-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/3620-3653-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/3708-1877-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/3888-1790-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/3900-2224-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/3920-2004-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/3972-788-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/3972-2007-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/4040-2032-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/4040-2030-0x0000000000440000-0x0000000000509000-memory.dmp

                                      Filesize

                                      804KB

                                      Download

                                    • memory/4040-2027-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/4076-4212-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/4084-3859-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/4084-3919-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/4156-4574-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/4156-4577-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/4224-2617-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/4244-2035-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/4252-2966-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/4252-2963-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/4312-3158-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/4348-2142-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/4396-1279-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/4464-938-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/4464-2018-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/4492-4568-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/4516-4984-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/4588-2798-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/4592-4109-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/4628-3333-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/4628-112-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/4628-106-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/4808-1736-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/4812-2607-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/5000-2405-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/5040-2245-0x0000000000400000-0x000000000043E000-memory.dmp

                                      Filesize

                                      248KB

                                      Download

                                    • memory/5072-994-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/5072-2028-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/5108-1612-0x0000000000400000-0x00000000005D3000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download