Overview

overview

10

Static

static

10

f851254ba1...18.exe

windows7-x64

10

f851254ba1...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-09-2024 11:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f851254ba146a024adec82a2fe7556a1_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    f851254ba146a024adec82a2fe7556a1

  • SHA1

    02ec9736f7f823b51921eb1763e9264374ceaa9c

  • SHA256

    63131b1e9d85887cf0966aab7791870c60d4d461a66211a1f8e3eb4df2dbb6e3

  • SHA512

    fba7a9ef87fa00e597586833f79c3b3455d8b51328a54c997529efab8cee8f6693872670832711fccc5aae17e8a67147dba27e29d47675fbc7a48fdc91903e37

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ1:0UzeyQMS4DqodCnoe+iitjWwwZ

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 53 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f851254ba146a024adec82a2fe7556a1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f851254ba146a024adec82a2fe7556a1_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3936
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:4548
      • C:\Users\Admin\AppData\Local\Temp\f851254ba146a024adec82a2fe7556a1_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\f851254ba146a024adec82a2fe7556a1_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1636
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:1132
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:64
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2868
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4892
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3616
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:4300
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:1968
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4308
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1476
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2196
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:4340
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4328
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4076
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:552
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:1240
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1964
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4088
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:2348
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:3228
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2592
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2020
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2980
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3860
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4860
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4824
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3176
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:4160
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3668
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1156
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:4692
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:436
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1208
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:3152
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4004
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3244
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:404
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1556
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1336
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:1548
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:812
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3064
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2096
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3036
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2716
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1372
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2524
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:432
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2068
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      PID:4752
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                          PID:4780
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:3524
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1620
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:1552
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1816
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    PID:3204
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:3320
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:3040
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:2864
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:1420
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:1236
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:2236
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                            PID:2188
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:428
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:4732
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      PID:4048
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:4272
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:456
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:2316
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:396
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:2948
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          7⤵
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:2144
                          • \??\c:\windows\system\explorer.exe
                            "c:\windows\system\explorer.exe"
                            8⤵
                            • System Location Discovery: System Language Discovery
                            PID:4852
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:3188
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:1324
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:3008
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        PID:2692
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          7⤵
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:1268
                          • \??\c:\windows\system\explorer.exe
                            "c:\windows\system\explorer.exe"
                            8⤵
                              PID:1164
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:2012
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                            PID:4836
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              7⤵
                              • System Location Discovery: System Language Discovery
                              PID:4960
                              • \??\c:\windows\system\explorer.exe
                                "c:\windows\system\explorer.exe"
                                8⤵
                                  PID:4696
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:3916
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:3356
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:940
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:2536
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:4464
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:4804
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:3856
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:4744
                                • \??\c:\windows\system\explorer.exe
                                  c:\windows\system\explorer.exe
                                  7⤵
                                    PID:672
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:1052
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2792
                                  • \??\c:\windows\system\explorer.exe
                                    c:\windows\system\explorer.exe
                                    7⤵
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    PID:5020
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                PID:2560
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                    PID:5040
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      7⤵
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:3768
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Suspicious use of SetThreadContext
                                  • System Location Discovery: System Language Discovery
                                  PID:3700
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                      PID:4632
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Suspicious use of SetThreadContext
                                    • Drops file in Windows directory
                                    PID:8
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4536
                                      • \??\c:\windows\system\explorer.exe
                                        c:\windows\system\explorer.exe
                                        7⤵
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        PID:3396
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Suspicious use of SetThreadContext
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    PID:3156
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                        PID:3976
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:1248
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4944
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:1996
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4736
                                        • \??\c:\windows\system\explorer.exe
                                          c:\windows\system\explorer.exe
                                          7⤵
                                          • Drops file in Windows directory
                                          • System Location Discovery: System Language Discovery
                                          PID:1040
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      PID:4280
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1692
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:1576
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2172
                                        • \??\c:\windows\system\explorer.exe
                                          c:\windows\system\explorer.exe
                                          7⤵
                                            PID:4508
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Drops file in Windows directory
                                        PID:2000
                                        • \??\c:\windows\system\spoolsv.exe
                                          "c:\windows\system\spoolsv.exe"
                                          6⤵
                                            PID:544
                                            • \??\c:\windows\system\explorer.exe
                                              c:\windows\system\explorer.exe
                                              7⤵
                                                PID:3220
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                            • Drops file in Windows directory
                                            PID:4928
                                            • \??\c:\windows\system\spoolsv.exe
                                              "c:\windows\system\spoolsv.exe"
                                              6⤵
                                                PID:828
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                                PID:4380
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:4920
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                PID:2896
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:2576
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:3640
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                PID:4812
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                PID:632
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:3644
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                  PID:1628
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                  • Drops file in Windows directory
                                                  PID:4972
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                  • Drops file in Windows directory
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2788
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                  • Drops file in Windows directory
                                                  PID:624
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4992
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                    PID:1540
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                      PID:4424
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                              1⤵
                                                PID:1716

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Windows\Parameters.ini
                                                Filesize

                                                74B

                                                MD5

                                                6687785d6a31cdf9a5f80acb3abc459b

                                                SHA1

                                                1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                                SHA256

                                                3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                                SHA512

                                                5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                                Download Submit

                                              • C:\Windows\System\explorer.exe
                                                Filesize

                                                2.2MB

                                                MD5

                                                28a7324b868dd21ec3b1cabae1fa7b74

                                                SHA1

                                                78b6e56521467d122dc0a03c8545d230a38d5350

                                                SHA256

                                                26dfb1d3477e4f85647e1c1fe5c4385e8494e788a2d340eac69b28199a0aab29

                                                SHA512

                                                de9b0d0b77e93ce6c3574c6dac6868aaaa3e444d157d494b4d619b591a37e8979e701de98b321987f49c5d39feee0e675e42f92c2f723a110d1633bccf58b704

                                                Download Submit

                                              • C:\Windows\System\spoolsv.exe
                                                Filesize

                                                2.2MB

                                                MD5

                                                3fb1c04aea7e144a0db1530955bb6a36

                                                SHA1

                                                c1e3501e93c21d8481c5648c04d8ba4ce5ff7dab

                                                SHA256

                                                b380861ec0170df597a4377e81c6f637fcbe2edd55606d3793648ad4e1697b42

                                                SHA512

                                                de8a7d594cc37007e9a11e4ed2e6675c1f7242e04ce8cc3bde76931ff2daf5422a6cfa133201a6c5da344c9abfb54234807f9f75829274938c6981cf790d16ca

                                                Download Submit

                                              • memory/64-4117-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/64-674-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/64-93-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/404-2460-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/432-1966-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/436-1517-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/544-5378-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/552-2085-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/552-2082-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/812-4201-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/828-5471-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/1132-94-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/1132-88-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/1164-4943-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/1208-2366-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/1208-2362-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/1236-2940-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/1236-3088-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/1240-1144-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/1324-3116-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/1336-2700-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/1336-2555-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/1372-1899-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/1476-2063-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/1476-956-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/1552-2054-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/1556-1769-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/1620-2729-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/1620-2725-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/1636-45-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/1636-82-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/1636-44-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/1692-5128-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/1816-2812-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/1964-2296-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/1964-2151-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/1968-885-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/1968-1986-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/2020-1256-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/2068-2874-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/2068-2717-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/2096-2568-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/2096-2564-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/2172-5336-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/2188-4710-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/2196-2061-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/2316-2970-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/2348-3701-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/2524-2655-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/2592-2162-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/2692-3409-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/2716-2577-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/2792-4629-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/2864-2849-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/2868-749-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/2868-1974-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/2948-3209-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/2948-3103-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/2980-2173-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/3036-1847-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/3040-2071-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/3064-1846-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/3152-1584-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/3176-2264-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/3176-2259-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/3204-2060-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/3228-1180-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/3244-1711-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/3320-2821-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/3320-2824-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/3356-4033-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/3356-3858-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/3524-1981-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/3668-2352-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/3860-1322-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/3936-48-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/3936-41-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/3936-42-0x0000000002480000-0x0000000002481000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3936-0-0x0000000002480000-0x0000000002481000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3976-4891-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/3976-4893-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4004-2374-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4076-1083-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/4160-1446-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/4272-2957-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4300-3500-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4308-1985-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4308-1982-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4308-1983-0x0000000000440000-0x0000000000509000-memory.dmp

                                                Filesize

                                                804KB

                                                Download

                                              • memory/4328-2072-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4340-1017-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/4464-4125-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4536-5017-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4692-3961-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4696-5387-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4736-5221-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4736-5115-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4744-4414-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4780-4508-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4824-1375-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download

                                              • memory/4836-3763-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4836-3688-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4852-4806-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4860-2181-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4860-2185-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4892-2134-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4892-1973-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/4944-4965-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download

                                              • memory/5040-4864-0x0000000000400000-0x000000000043E000-memory.dmp

                                                Filesize

                                                248KB

                                                Download