pony | 82b08b85e60227bcd7b95645a2cbfd6341e8de9c740865063fab712227df2799

Resubmissions

24-03-2024 05:05

240324-fq3jnace9y 10

21-03-2024 20:55

240321-zqmyraaa99 10

Analysis

max time kernel
150s
max time network
131s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
21-03-2024 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
Size

655KB
MD5

dc97ae4dbd3d7610c97a1e8ea826b5c3
SHA1

ac372a39625752355e982e814c7836720648ae52
SHA256

82b08b85e60227bcd7b95645a2cbfd6341e8de9c740865063fab712227df2799
SHA512

cb0547baa60fdc876d85431e6878fd88e368810d4884d384e6a9219d854be008ddcaaa8fb0f00df1277d70caa803cd4561ba6407f1876b3e0822b86ec6cce007
SSDEEP

12288:/ESqJwbBEE+tOi9c2xwlqXs4zUmvycM6xgNyJ6DsZuhEP60dIIFazZyun23:/EdYj+j9c21lz/VnxgAJxuOCciZzE

Score

10^/10

pony discovery evasion persistence rat spyware stealer upx

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

behost.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" behost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3"	behost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

R07924.exezghoq.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	R07924.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	zghoq.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony
Disables taskbar notifications via registry modification
evasion

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1576 cmd.exe
Executes dropped EXE 9 IoCs

Processes:

R07924.exezghoq.exeaehost.exebehost.execehost.exedehost.exebehost.exebehost.exe8B20.tmp

pid process

2056 R07924.exe
2708 zghoq.exe
1516 aehost.exe
2628 behost.exe
2760 cehost.exe
2316 dehost.exe
836 behost.exe
2532 behost.exe
1288 8B20.tmp

pid	process
1576	cmd.exe

Loads dropped DLL 14 IoCs

Processes:

dc97ae4dbd3d7610c97a1e8ea826b5c3.exeR07924.exebehost.exe

pid	process
1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
2056	R07924.exe
2056	R07924.exe
1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
2628	behost.exe
2628	behost.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1276-2-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/1276-4-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/1276-6-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/1276-12-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/1276-14-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/1276-15-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/1276-52-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/2628-117-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/836-119-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2628-126-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2628-184-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2532-191-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/1276-316-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/2628-320-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2628-329-0x0000000000400000-0x0000000000469000-memory.dmp	upx

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

zghoq.exebehost.exeR07924.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /F"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /W"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /R"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /w"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /j"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /a"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /N"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /O"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /X"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /t"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /H"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /G"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /d"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /m"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /e"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /E"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /p"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /J"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /l"	zghoq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\700.exe = "C:\\Program Files (x86)\\LP\\3A04\\700.exe"	behost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /U"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /c"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /b"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /Z"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /n"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /A"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /h"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /k"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /I"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /B"	R07924.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /f"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /T"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /C"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /i"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /S"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /v"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /L"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /Q"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /o"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /D"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /y"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /q"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /V"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /r"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /s"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /g"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /P"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /K"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /Y"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /M"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /z"	zghoq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\zghoq = "C:\\Users\\Admin\\zghoq.exe /x"	zghoq.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 2 IoCs

Processes:

dc97ae4dbd3d7610c97a1e8ea826b5c3.execehost.exe

description	pid	process	target process
PID 1624 set thread context of 1276	1624	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
PID 2760 set thread context of 2844	2760	cehost.exe	explorer.exe

Drops file in Program Files directory 3 IoCs

Processes:

behost.exe

description	ioc	process
File created	C:\Program Files (x86)\LP\3A04\700.exe	behost.exe
File opened for modification	C:\Program Files (x86)\LP\3A04\8B20.tmp	behost.exe
File opened for modification	C:\Program Files (x86)\LP\3A04\700.exe	behost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

2808 tasklist.exe
1592 tasklist.exe

pid	process
2808	tasklist.exe
1592	tasklist.exe

Modifies registry class 8 IoCs

Processes:

explorer.exeexplorer.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{848ef40d-f65f-2e8d-fc0f-fd7fd37f436f}\u = "860049491"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{848ef40d-f65f-2e8d-fc0f-fd7fd37f436f}\cid = "193268868771433493"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\registry\machine\Software\Classes\Interface\{848ef40d-f65f-2e8d-fc0f-fd7fd37f436f}	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

R07924.exezghoq.exebehost.exeexplorer.exe

pid	process
2056	R07924.exe
2056	R07924.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2628	behost.exe
2628	behost.exe
2628	behost.exe
2628	behost.exe
2628	behost.exe
2628	behost.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe
2844	explorer.exe
2844	explorer.exe
2708	zghoq.exe
2708	zghoq.exe
2708	zghoq.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

2612 explorer.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

tasklist.exemsiexec.exeexplorer.exeexplorer.exetasklist.exe

description	pid	process
Token: SeDebugPrivilege	2808	tasklist.exe
Token: SeRestorePrivilege	2028	msiexec.exe
Token: SeTakeOwnershipPrivilege	2028	msiexec.exe
Token: SeSecurityPrivilege	2028	msiexec.exe
Token: SeDebugPrivilege	2844	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeDebugPrivilege	1592	tasklist.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe

Suspicious use of FindShellTrayWindow 28 IoCs

Processes:

explorer.exe

pid	process
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

explorer.exe

pid	process
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

dc97ae4dbd3d7610c97a1e8ea826b5c3.exeR07924.exezghoq.exedehost.exe

pid process

1276 dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
2056 R07924.exe
2708 zghoq.exe
2316 dehost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

dc97ae4dbd3d7610c97a1e8ea826b5c3.exedc97ae4dbd3d7610c97a1e8ea826b5c3.exeR07924.execmd.execehost.exebehost.execmd.exe

description	pid	process	target process
PID 1624 wrote to memory of 1276	1624	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
PID 1624 wrote to memory of 1276	1624	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
PID 1624 wrote to memory of 1276	1624	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
PID 1624 wrote to memory of 1276	1624	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
PID 1624 wrote to memory of 1276	1624	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
PID 1624 wrote to memory of 1276	1624	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
PID 1624 wrote to memory of 1276	1624	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
PID 1624 wrote to memory of 1276	1624	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
PID 1276 wrote to memory of 2056	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	R07924.exe
PID 1276 wrote to memory of 2056	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	R07924.exe
PID 1276 wrote to memory of 2056	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	R07924.exe
PID 1276 wrote to memory of 2056	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	R07924.exe
PID 2056 wrote to memory of 2708	2056	R07924.exe	zghoq.exe
PID 2056 wrote to memory of 2708	2056	R07924.exe	zghoq.exe
PID 2056 wrote to memory of 2708	2056	R07924.exe	zghoq.exe
PID 2056 wrote to memory of 2708	2056	R07924.exe	zghoq.exe
PID 1276 wrote to memory of 1516	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	aehost.exe
PID 1276 wrote to memory of 1516	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	aehost.exe
PID 1276 wrote to memory of 1516	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	aehost.exe
PID 1276 wrote to memory of 1516	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	aehost.exe
PID 2056 wrote to memory of 2756	2056	R07924.exe	cmd.exe
PID 2056 wrote to memory of 2756	2056	R07924.exe	cmd.exe
PID 2056 wrote to memory of 2756	2056	R07924.exe	cmd.exe
PID 2056 wrote to memory of 2756	2056	R07924.exe	cmd.exe
PID 2756 wrote to memory of 2808	2756	cmd.exe	tasklist.exe
PID 2756 wrote to memory of 2808	2756	cmd.exe	tasklist.exe
PID 2756 wrote to memory of 2808	2756	cmd.exe	tasklist.exe
PID 2756 wrote to memory of 2808	2756	cmd.exe	tasklist.exe
PID 1276 wrote to memory of 2628	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	behost.exe
PID 1276 wrote to memory of 2628	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	behost.exe
PID 1276 wrote to memory of 2628	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	behost.exe
PID 1276 wrote to memory of 2628	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	behost.exe
PID 1276 wrote to memory of 2760	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	cehost.exe
PID 1276 wrote to memory of 2760	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	cehost.exe
PID 1276 wrote to memory of 2760	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	cehost.exe
PID 1276 wrote to memory of 2760	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	cehost.exe
PID 2760 wrote to memory of 2844	2760	cehost.exe	explorer.exe
PID 2760 wrote to memory of 2844	2760	cehost.exe	explorer.exe
PID 2760 wrote to memory of 2844	2760	cehost.exe	explorer.exe
PID 2760 wrote to memory of 2844	2760	cehost.exe	explorer.exe
PID 2760 wrote to memory of 2844	2760	cehost.exe	explorer.exe
PID 1276 wrote to memory of 2316	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dehost.exe
PID 1276 wrote to memory of 2316	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dehost.exe
PID 1276 wrote to memory of 2316	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dehost.exe
PID 1276 wrote to memory of 2316	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dehost.exe
PID 2628 wrote to memory of 836	2628	behost.exe	behost.exe
PID 2628 wrote to memory of 836	2628	behost.exe	behost.exe
PID 2628 wrote to memory of 836	2628	behost.exe	behost.exe
PID 2628 wrote to memory of 836	2628	behost.exe	behost.exe
PID 2628 wrote to memory of 2532	2628	behost.exe	behost.exe
PID 2628 wrote to memory of 2532	2628	behost.exe	behost.exe
PID 2628 wrote to memory of 2532	2628	behost.exe	behost.exe
PID 2628 wrote to memory of 2532	2628	behost.exe	behost.exe
PID 2628 wrote to memory of 1288	2628	behost.exe	8B20.tmp
PID 2628 wrote to memory of 1288	2628	behost.exe	8B20.tmp
PID 2628 wrote to memory of 1288	2628	behost.exe	8B20.tmp
PID 2628 wrote to memory of 1288	2628	behost.exe	8B20.tmp
PID 1276 wrote to memory of 1576	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	cmd.exe
PID 1276 wrote to memory of 1576	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	cmd.exe
PID 1276 wrote to memory of 1576	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	cmd.exe
PID 1276 wrote to memory of 1576	1276	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	cmd.exe
PID 1576 wrote to memory of 1592	1576	cmd.exe	tasklist.exe
PID 1576 wrote to memory of 1592	1576	cmd.exe	tasklist.exe
PID 1576 wrote to memory of 1592	1576	cmd.exe	tasklist.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

behost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	behost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	behost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
"C:\Users\Admin\AppData\Local\Temp\dc97ae4dbd3d7610c97a1e8ea826b5c3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1624

C:\Users\Admin\AppData\Local\Temp\dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276

C:\Users\Admin\R07924.exe
C:\Users\Admin\R07924.exe
3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056

C:\Users\Admin\zghoq.exe
"C:\Users\Admin\zghoq.exe"
4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2708

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c tasklist&&del R07924.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\SysWOW64\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2808

C:\Users\Admin\aehost.exe
C:\Users\Admin\aehost.exe
3⤵
- Executes dropped EXE
PID:1516

C:\Users\Admin\behost.exe
C:\Users\Admin\behost.exe
3⤵
- Modifies security service
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2628

C:\Users\Admin\behost.exe
C:\Users\Admin\behost.exe startC:\Users\Admin\AppData\Roaming\401C3\5ED3A.exe%C:\Users\Admin\AppData\Roaming\401C3
4⤵
- Executes dropped EXE
PID:836

C:\Users\Admin\behost.exe
C:\Users\Admin\behost.exe startC:\Program Files (x86)\C3919\lvvm.exe%C:\Program Files (x86)\C3919
4⤵
- Executes dropped EXE
PID:2532

C:\Program Files (x86)\LP\3A04\8B20.tmp
"C:\Program Files (x86)\LP\3A04\8B20.tmp"
4⤵
- Executes dropped EXE
PID:1288

C:\Users\Admin\cehost.exe
C:\Users\Admin\cehost.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\explorer.exe
000000C0*
4⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2844

C:\Users\Admin\dehost.exe
C:\Users\Admin\dehost.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2316

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c tasklist&&del dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2028

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2612

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Process Discovery

T1057

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\401C3\3919.01C
Filesize
600B

MD5
a75ffe727f97a64e25c68e3ed541e02e

SHA1
ad383fb4dc97a22e24891ca2c2c96aa962506741

SHA256
c2192248fa7b58d5f8600c20de35d3661b0231afbba50b5e77619dc8823e84b0

SHA512
ebd9c25fc8ce7f136cf9114254ea66ef8ff077599660ecd0bf41614d893a097ef6a87e00d6bdf3848778ccdc3c0240ebcfd363b123417b98e15bb779ee1caa12

Download Submit
C:\Users\Admin\AppData\Roaming\401C3\3919.01C
Filesize
996B

MD5
cb7b6cf6a53d9a30abeeb81dd80946ab

SHA1
7aa36aa8d9cfc6a0482b37f0d31a02e4adf9ad20

SHA256
cbadda6d7b6210c854b1a153daa7aeafea5055c233834f0044559d4b7cc1eb85

SHA512
49f85f98c3828c3b58a64ae27998c12b6522c3db7a6630685102e79a72d9a41af01469df43c6bf950698f56ade64714d0a488d8f63c8cbd65fddde5e1625c60f

Download Submit
C:\Users\Admin\AppData\Roaming\401C3\3919.01C
Filesize
1KB

MD5
0e37809b6d9dc54cbd52d5bd7dee90d9

SHA1
4a756188485d3d03b6d31b16f98a12e5fac93c71

SHA256
e4c50b0786391a2039734ce0c95d87256a1727651e2cecfaf3853ed0d2652ee3

SHA512
426da3622ed3a484c845f74685f0e9f2410e6a56f14e1e51bcb44bb2d3db2ae104412f270358fad1490b6b4f8978211e7ac312aadcafaff0007bcd8e4d858755

Download Submit
C:\Users\Admin\AppData\Roaming\401C3\3919.01C
Filesize
1KB

MD5
ea6c4503b0a1fbfa0436584a5613caf4

SHA1
de7232b83bc5ca80c6763c9cb1560d8ef5899acc

SHA256
ddb4d17a58abae8cba522c9d4c105884fff3f1894e256635013ae5fee0505429

SHA512
a415b5c8ee1eb433a83eb8b520f40e98edcf3eb5c14a022134b1e8501aeac9e0876b9cf1c1c1ed7941fca8bc7412f0f7df6a4bf8424b79d6974a1a3f23fff50f

Download Submit
C:\Users\Admin\aehost.exe
Filesize
129KB

MD5
e2b1704acdf48221cd9be91bae3546c5

SHA1
f53a59b62276f58cf8689768f747e16f53dbd341

SHA256
8b1c13bb2e95f71ed75d8fca7aeefc556ecd377d5d4f6c544d77ac8f74255ca5

SHA512
1b3d8baa981851a79c4f12f3ea2a4d197b3439e76ca723acd578acabd731310d6eeb3a4567a10d48f45192ae9c4cd732eca04c0a7fffa636e7bd364ed1357b53

Download Submit
C:\Users\Admin\cehost.exe
Filesize
145KB

MD5
56be9270582de0986c72139ea218e121

SHA1
d33b8a2127ccf6b6f42a0c0f266136a376def18c

SHA256
8b40a882fde5ef3df2ec3112142b654c949adf7f559bc1912ad9d08ebb17c257

SHA512
dcee7d3d16e19e5a36a386d097c171ed7761ad4fc626b5d523b9c33f952fa24da733c56fcb8ff440894c3672c468d04cecc001ae9a680a9607347a5f517e6023

Download Submit
\Program Files (x86)\LP\3A04\8B20.tmp
Filesize
104KB

MD5
0cb09d0443d2eda312058ae1a2fa83c2

SHA1
1888844fcab4269a5c08b5cf122b100e8abb3cb0

SHA256
50a9af2fe05dd06d6ff825bcf2106b64385e7fdf9a06a0a18ac187c4a057503a

SHA512
93bfdc4d14a7ba7cce25d0a83faa29e0efa7932f3024aa82fcc1d606cb9a65e0ebd91942ad9992ce787f639df1748fde9599cb9b676245a17a8198064df2e24c

Download Submit
\Users\Admin\R07924.exe
Filesize
188KB

MD5
4f9c5823c5d1255ded151b01c0a58e15

SHA1
2f7018a9211472ddfa5d2f09629bf90adce4676c

SHA256
e38564871dc5952e2d1d22d51e312e3064cf84df95c0420021153cb5c264adcf

SHA512
b5518effbf476d9486a5ddaa65c937e97b10470d533f8e0c9af30956868c032f6bdb524d13a004e4a0d19e9a88b5f3f11ee82e5602b1175092fb36a9959d40ca

Download Submit
\Users\Admin\behost.exe
Filesize
279KB

MD5
2a583120a51178ee5f8bc2727faaa73e

SHA1
91296d42eeddb285aeea28f5139cadda10f21df7

SHA256
b315e97fff3561563da4dcf7283636f42eef9ebaf422506e01f03716d4877b02

SHA512
003e11b916256091486311881a06286d532a9940d75977a44afa3c116277a0f490505e9b4053f56846fb6d1d7584d7748f622bc9cae088af93820452027dac8b

Download Submit
\Users\Admin\dehost.exe
Filesize
24KB

MD5
7cda5863b933988b7bd1d0c8035dafd9

SHA1
68c64d655d0df1c9974587d12b3b88f5ce1f4cac

SHA256
400cb530f1489c46ada1dedc35b51cb53e8174f5cdda0d086ef593c135e0f216

SHA512
978440c09b70b695fdc171c6e2a7c064aa078d4a300db7f297afde5e3c1cfdf513da01dae967a9a8c524c185432ef87bf922a5cc97a9c8a6d1fd9cc3155e0aea

Download Submit
\Users\Admin\zghoq.exe
Filesize
188KB

MD5
df51393de519595064c630df87c3b51e

SHA1
12cf7ceb9f694b3b9e7e596cf3352e008b4f377e

SHA256
e74dba12d9656505e2e6ec54a00db326a1c89b4cc7ca48c27f267ec2e950f0ce

SHA512
cdef80790ce6110068ec7206bf7332c11daf97a2c036ddfca54dcb2cce7d1fd75b4ff7a4a2b50b8d9a9fe1fe810a7d0f601023eb504280bfcafa798a00b4787d

Download Submit
memory/836-119-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/836-120-0x00000000002D0000-0x0000000000317000-memory.dmp

Filesize
284KB

Download
memory/1276-316-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1276-14-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1276-0-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1276-2-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1276-15-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1276-4-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1276-6-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1276-52-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1276-77-0x0000000000390000-0x00000000003D2000-memory.dmp

Filesize
264KB

Download
memory/1276-78-0x0000000000390000-0x00000000003D2000-memory.dmp

Filesize
264KB

Download
memory/1276-12-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1276-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1288-322-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1288-283-0x0000000000860000-0x0000000000960000-memory.dmp

Filesize
1024KB

Download
memory/1288-282-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1288-321-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1516-55-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1516-125-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1516-337-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1516-332-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1516-330-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1516-328-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1516-53-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1516-325-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1516-323-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1516-57-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1516-194-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1516-183-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1516-319-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1624-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2056-44-0x0000000003330000-0x0000000003DEA000-memory.dmp

Filesize
10.7MB

Download
memory/2532-191-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2532-192-0x0000000001C90000-0x0000000001D90000-memory.dmp

Filesize
1024KB

Download
memory/2612-318-0x0000000004440000-0x0000000004441000-memory.dmp

Filesize
4KB

Download
memory/2612-327-0x0000000004440000-0x0000000004441000-memory.dmp

Filesize
4KB

Download
memory/2628-320-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2628-127-0x0000000001CA0000-0x0000000001DA0000-memory.dmp

Filesize
1024KB

Download
memory/2628-68-0x0000000001CA0000-0x0000000001DA0000-memory.dmp

Filesize
1024KB

Download
memory/2628-67-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2628-329-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2628-117-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2628-184-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2628-126-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2760-81-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2760-83-0x00000000005E0000-0x0000000000622000-memory.dmp

Filesize
264KB

Download
memory/2760-82-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2760-85-0x00000000005E1000-0x00000000005E2000-memory.dmp

Filesize
4KB

Download
memory/2760-79-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2760-88-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2760-80-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2844-87-0x0000000000060000-0x0000000000075000-memory.dmp

Filesize
84KB

Download
memory/2844-100-0x0000000000300000-0x0000000000319000-memory.dmp

Filesize
100KB

Download
memory/2844-95-0x0000000000300000-0x0000000000319000-memory.dmp

Filesize
100KB

Download
memory/2844-89-0x0000000000300000-0x0000000000319000-memory.dmp

Filesize
100KB

Download