Overview

overview

10

Static

static

10

da3fe552bf...18.exe

windows7-x64

10

da3fe552bf...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-12-2024 15:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    da3fe552bf2430ca5f0a62c3b2882872_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    da3fe552bf2430ca5f0a62c3b2882872

  • SHA1

    6c9256fb8409202325c2b1a638263e00db01610d

  • SHA256

    535e8cf0f840fb6579d51bf5df76c3a03a63f8872d3dbfdf1ff62ee26b49f5bf

  • SHA512

    80c77888a2f1852c1db9e9bdfe738ebfac1df0d8f677cecbd052b743028062213515bd8f2a3bd97f280d50b8925a06c8c98096209f5be176a3be75bc4e334c26

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZV:0UzeyQMS4DqodCnoe+iitjWwwp

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 57 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\da3fe552bf2430ca5f0a62c3b2882872_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\da3fe552bf2430ca5f0a62c3b2882872_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1276
      • C:\Users\Admin\AppData\Local\Temp\da3fe552bf2430ca5f0a62c3b2882872_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\da3fe552bf2430ca5f0a62c3b2882872_JaffaCakes118.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4944
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4672
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1060
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:3660
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2640
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4752
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1328
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2832
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3044
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:3680
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4156
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:3340
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4192
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:3056
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2880
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:3232
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1704
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:760
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3220
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:468
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3644
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:4012
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3384
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:2320
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3716
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4504
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4440
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3464
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:5132
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4292
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1604
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4716
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3540
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:2372
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1960
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2032
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2280
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2228
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:312
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3468
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1444
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:756
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1608
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2520
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2352
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2868
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2304
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3096
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:384
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4040
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:4368
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:3712
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4428
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Suspicious use of SetThreadContext
                    PID:4548
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:5476
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:3616
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:2784
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1352
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:948
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4640
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1048
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4404
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:1940
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1916
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2016
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1944
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                    PID:4260
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:2328
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:3052
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4204
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:1660
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:556
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:336
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:828
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:1744
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:2564
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                      PID:452
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:2628
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                        PID:1044
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:3968
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                          PID:2544
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:1488
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                            PID:4384
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:3948
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:4836
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:3164
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:428
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                PID:920
                                • \??\c:\windows\system\explorer.exe
                                  "c:\windows\system\explorer.exe"
                                  8⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1968
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:656
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:3536
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                PID:4436
                                • \??\c:\windows\system\explorer.exe
                                  "c:\windows\system\explorer.exe"
                                  8⤵
                                    PID:4620
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:440
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                  PID:2712
                                  • \??\c:\windows\system\explorer.exe
                                    c:\windows\system\explorer.exe
                                    7⤵
                                      PID:2024
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  PID:1452
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                      PID:5388
                                      • \??\c:\windows\system\explorer.exe
                                        c:\windows\system\explorer.exe
                                        7⤵
                                          PID:5436
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Suspicious use of SetThreadContext
                                      PID:1336
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                          PID:5888
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Suspicious use of SetThreadContext
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        PID:1740
                                        • \??\c:\windows\system\spoolsv.exe
                                          "c:\windows\system\spoolsv.exe"
                                          6⤵
                                            PID:2060
                                            • \??\c:\windows\system\explorer.exe
                                              c:\windows\system\explorer.exe
                                              7⤵
                                              • Drops file in Windows directory
                                              • System Location Discovery: System Language Discovery
                                              PID:2688
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Suspicious use of SetThreadContext
                                          • Drops file in Windows directory
                                          • System Location Discovery: System Language Discovery
                                          PID:2280
                                          • \??\c:\windows\system\spoolsv.exe
                                            "c:\windows\system\spoolsv.exe"
                                            6⤵
                                              PID:5596
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                            • Suspicious use of SetThreadContext
                                            • System Location Discovery: System Language Discovery
                                            PID:2936
                                            • \??\c:\windows\system\spoolsv.exe
                                              "c:\windows\system\spoolsv.exe"
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:5136
                                              • \??\c:\windows\system\explorer.exe
                                                c:\windows\system\explorer.exe
                                                7⤵
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                PID:5280
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                            • Suspicious use of SetThreadContext
                                            PID:4448
                                            • \??\c:\windows\system\spoolsv.exe
                                              "c:\windows\system\spoolsv.exe"
                                              6⤵
                                                PID:2044
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Suspicious use of SetThreadContext
                                              • Drops file in Windows directory
                                              PID:3312
                                              • \??\c:\windows\system\spoolsv.exe
                                                "c:\windows\system\spoolsv.exe"
                                                6⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:6064
                                                • \??\c:\windows\system\explorer.exe
                                                  c:\windows\system\explorer.exe
                                                  7⤵
                                                  • Drops file in Windows directory
                                                  PID:6140
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Suspicious use of SetThreadContext
                                              • Drops file in Windows directory
                                              • System Location Discovery: System Language Discovery
                                              PID:456
                                              • \??\c:\windows\system\spoolsv.exe
                                                "c:\windows\system\spoolsv.exe"
                                                6⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:1112
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Suspicious use of SetThreadContext
                                              • System Location Discovery: System Language Discovery
                                              PID:832
                                              • \??\c:\windows\system\spoolsv.exe
                                                "c:\windows\system\spoolsv.exe"
                                                6⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:5932
                                                • \??\c:\windows\system\explorer.exe
                                                  c:\windows\system\explorer.exe
                                                  7⤵
                                                    PID:5432
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:1220
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:1120
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:3760
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:4928
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:516
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:1532
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                PID:612
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:740
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:3108
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:2700
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:5024
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:2172
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:1728
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:3568
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                PID:4764
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:4420
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                PID:4728
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:5304
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:5784
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                PID:5396
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:5984
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:5212
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                PID:5728
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:5268
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:5980
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                        1⤵
                                          PID:3060

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Windows\Parameters.ini
                                          Filesize

                                          74B

                                          MD5

                                          6687785d6a31cdf9a5f80acb3abc459b

                                          SHA1

                                          1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                          SHA256

                                          3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                          SHA512

                                          5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                          Download Submit

                                        • C:\Windows\System\explorer.exe
                                          Filesize

                                          2.2MB

                                          MD5

                                          9769e4249148ac8b4d4ee1d1c05559f0

                                          SHA1

                                          b888b7000f88efd593a6712e6a1a031096624b74

                                          SHA256

                                          8b0a7e6f9072f044f3ca636e287d691939b7e84c94391fe6841c9e839df8b6c1

                                          SHA512

                                          8ec01347f06e5574025b28a8d96b974dd19f8c3155da8d252c9bb02aebc8541bd6839124a90d47de8a34e8eb5f0791cfe14a286e621ec2cb8ccb645ee5c45660

                                          Download Submit

                                        • C:\Windows\System\spoolsv.exe
                                          Filesize

                                          2.2MB

                                          MD5

                                          5dda115d65236eb46c85d706c911804d

                                          SHA1

                                          01f09dbd68c8037170df34771fba2b6356d5c9f4

                                          SHA256

                                          8a57af23368e9c9278643459d14b00005d2977650f36de9e82fe547ad4b2af82

                                          SHA512

                                          fd7a821d9f5d9b12891e03c259460aeb746a5bc929d4ff18fe90abb9ea608437f18d24bd5cc855561c0214b4723411326da8dc101a2a3c4f70f9660060185cbf

                                          Download Submit

                                        • memory/312-2889-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/336-3138-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/384-2952-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/428-3473-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/452-3216-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/468-1722-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/756-2231-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/760-1611-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/948-3027-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/1044-3244-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/1048-3071-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/1060-84-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/1060-809-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/1112-5780-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/1328-3686-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/1352-2391-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/1444-2901-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/1604-2846-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/1608-2916-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/1704-2619-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/1744-3149-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/1916-2517-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/1940-3101-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/1944-2518-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/1960-2869-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/1968-5334-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/2032-2112-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/2060-5417-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/2060-5477-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/2228-2113-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/2280-2878-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/2320-1859-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/2328-2534-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/2352-2928-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/2372-2050-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/2520-2299-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/2544-3254-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/2640-2524-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/2640-2737-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/2712-4860-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/2784-2982-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/2832-1056-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/2832-2535-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/2868-2300-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/2880-2606-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/2880-2609-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/2988-37-0x0000000002480000-0x0000000002481000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/2988-36-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/2988-0-0x0000000002480000-0x0000000002481000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/2988-42-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/3044-2533-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/3052-3118-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/3056-1411-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/3096-2301-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/3220-2629-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/3232-1415-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/3340-1173-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/3384-2650-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/3468-2230-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/3536-3808-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/3540-2858-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/3616-2390-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/3644-2637-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/3660-910-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/3660-2525-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/3680-1067-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/3712-2389-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/3716-2670-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/4012-1858-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/4040-2302-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/4156-2559-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/4192-2595-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/4260-3119-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/4292-2022-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/4368-2964-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/4384-3266-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/4384-3261-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/4404-2514-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/4428-3328-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/4428-2973-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/4440-2835-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/4440-2960-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/4504-1995-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/4620-5692-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/4640-2513-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/4672-80-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/4672-85-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/4716-2049-0x0000000000400000-0x00000000005D3000-memory.dmp

                                          Filesize

                                          1.8MB

                                          Download

                                        • memory/4836-3275-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/4944-39-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/4944-69-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/4944-40-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/4944-67-0x0000000000440000-0x0000000000509000-memory.dmp

                                          Filesize

                                          804KB

                                          Download

                                        • memory/5132-5134-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/5136-5612-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/5136-5740-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/5388-5159-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/5476-5169-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/5596-5428-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/5888-5261-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/5932-5998-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/6064-5769-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download

                                        • memory/6064-5900-0x0000000000400000-0x000000000043E000-memory.dmp

                                          Filesize

                                          248KB

                                          Download