pony | 82b08b85e60227bcd7b95645a2cbfd6341e8de9c740865063fab712227df2799

Resubmissions

24-03-2024 05:05

240324-fq3jnace9y 10

21-03-2024 20:55

240321-zqmyraaa99 10

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24-03-2024 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
Size

655KB
MD5

dc97ae4dbd3d7610c97a1e8ea826b5c3
SHA1

ac372a39625752355e982e814c7836720648ae52
SHA256

82b08b85e60227bcd7b95645a2cbfd6341e8de9c740865063fab712227df2799
SHA512

cb0547baa60fdc876d85431e6878fd88e368810d4884d384e6a9219d854be008ddcaaa8fb0f00df1277d70caa803cd4561ba6407f1876b3e0822b86ec6cce007
SSDEEP

12288:/ESqJwbBEE+tOi9c2xwlqXs4zUmvycM6xgNyJ6DsZuhEP60dIIFazZyun23:/EdYj+j9c21lz/VnxgAJxuOCciZzE

Score

10^/10

pony discovery evasion persistence rat spyware stealer upx

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

behost.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" behost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3"	behost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

R07924.exedlmij.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	R07924.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	dlmij.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony
Disables taskbar notifications via registry modification
evasion

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2084 cmd.exe
Executes dropped EXE 10 IoCs

Processes:

R07924.exedlmij.exeaehost.exeaehost.exebehost.execehost.exedehost.exebehost.exebehost.exeEED2.tmp

pid process

2608 R07924.exe
1972 dlmij.exe
2832 aehost.exe
1524 aehost.exe
1564 behost.exe
2472 cehost.exe
2948 dehost.exe
664 behost.exe
2536 behost.exe
544 EED2.tmp

pid	process
2084	cmd.exe

Loads dropped DLL 14 IoCs

Processes:

dc97ae4dbd3d7610c97a1e8ea826b5c3.exeR07924.exebehost.exe

pid	process
2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
2608	R07924.exe
2608	R07924.exe
2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
1564	behost.exe
1564	behost.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2888-2-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/2888-5-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/2888-3-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/2888-11-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/2888-13-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/2888-12-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/2888-49-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/1564-84-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/664-136-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/1564-142-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2536-206-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/1564-210-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/2888-335-0x0000000000400000-0x00000000004C9000-memory.dmp	upx

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

dlmij.exebehost.exeR07924.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /d"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /W"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /E"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /Y"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /a"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /j"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /i"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /s"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /n"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /x"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /M"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /U"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /F"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /f"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /D"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /p"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /c"	dlmij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\316.exe = "C:\\Program Files (x86)\\LP\\D3A3\\316.exe"	behost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /P"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /K"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /S"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /u"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /X"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /r"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /C"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /G"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /L"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /z"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /m"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /B"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /g"	R07924.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /O"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /l"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /w"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /t"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /A"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /I"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /e"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /T"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /v"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /g"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /q"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /h"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /R"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /Z"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /o"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /b"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /y"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /Q"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /N"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /H"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /J"	dlmij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\dlmij = "C:\\Users\\Admin\\dlmij.exe /k"	dlmij.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 3 IoCs

Processes:

dc97ae4dbd3d7610c97a1e8ea826b5c3.exeaehost.execehost.exe

description	pid	process	target process
PID 3036 set thread context of 2888	3036	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
PID 2832 set thread context of 1524	2832	aehost.exe	aehost.exe
PID 2472 set thread context of 1408	2472	cehost.exe	explorer.exe

Drops file in Program Files directory 3 IoCs

Processes:

behost.exe

description	ioc	process
File created	C:\Program Files (x86)\LP\D3A3\316.exe	behost.exe
File opened for modification	C:\Program Files (x86)\LP\D3A3\EED2.tmp	behost.exe
File opened for modification	C:\Program Files (x86)\LP\D3A3\316.exe	behost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

2380 tasklist.exe
2804 tasklist.exe

pid	process
2380	tasklist.exe
2804	tasklist.exe

Modifies registry class 8 IoCs

Processes:

explorer.exeexplorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	explorer.exe
Key created	\registry\machine\Software\Classes\Interface\{99d144a9-1252-7ece-38c3-a14db5aabc7e}	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99d144a9-1252-7ece-38c3-a14db5aabc7e}\u = "860049491"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99d144a9-1252-7ece-38c3-a14db5aabc7e}\cid = "7531242965536367694"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

R07924.exedlmij.exeaehost.exebehost.exeexplorer.exe

pid	process
2608	R07924.exe
2608	R07924.exe
1972	dlmij.exe
1972	dlmij.exe
1972	dlmij.exe
1972	dlmij.exe
1972	dlmij.exe
1972	dlmij.exe
1972	dlmij.exe
1972	dlmij.exe
1972	dlmij.exe
1972	dlmij.exe
1524	aehost.exe
1972	dlmij.exe
1972	dlmij.exe
1564	behost.exe
1564	behost.exe
1564	behost.exe
1564	behost.exe
1564	behost.exe
1564	behost.exe
1972	dlmij.exe
1972	dlmij.exe
1524	aehost.exe
1972	dlmij.exe
1408	explorer.exe
1408	explorer.exe
1972	dlmij.exe
1972	dlmij.exe
1972	dlmij.exe
1524	aehost.exe
1972	dlmij.exe
1524	aehost.exe
1524	aehost.exe
1972	dlmij.exe
1972	dlmij.exe
1972	dlmij.exe
1524	aehost.exe
1524	aehost.exe
1972	dlmij.exe
1524	aehost.exe
1972	dlmij.exe
1972	dlmij.exe
1524	aehost.exe
1972	dlmij.exe
1524	aehost.exe
1972	dlmij.exe
1524	aehost.exe
1972	dlmij.exe
1524	aehost.exe
1524	aehost.exe
1972	dlmij.exe
1524	aehost.exe
1972	dlmij.exe
1524	aehost.exe
1972	dlmij.exe
1524	aehost.exe
1972	dlmij.exe
1524	aehost.exe
1524	aehost.exe
1972	dlmij.exe
1524	aehost.exe
1972	dlmij.exe
1524	aehost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

3068 explorer.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

tasklist.exemsiexec.exeexplorer.exeexplorer.exetasklist.exe

description	pid	process
Token: SeDebugPrivilege	2380	tasklist.exe
Token: SeRestorePrivilege	1808	msiexec.exe
Token: SeTakeOwnershipPrivilege	1808	msiexec.exe
Token: SeSecurityPrivilege	1808	msiexec.exe
Token: SeDebugPrivilege	1408	explorer.exe
Token: SeShutdownPrivilege	3068	explorer.exe
Token: SeShutdownPrivilege	3068	explorer.exe
Token: SeShutdownPrivilege	3068	explorer.exe
Token: SeShutdownPrivilege	3068	explorer.exe
Token: SeShutdownPrivilege	3068	explorer.exe
Token: SeShutdownPrivilege	3068	explorer.exe
Token: SeShutdownPrivilege	3068	explorer.exe
Token: SeShutdownPrivilege	3068	explorer.exe
Token: SeShutdownPrivilege	3068	explorer.exe
Token: SeShutdownPrivilege	3068	explorer.exe
Token: SeDebugPrivilege	2804	tasklist.exe
Token: SeShutdownPrivilege	3068	explorer.exe
Token: SeShutdownPrivilege	3068	explorer.exe
Token: SeShutdownPrivilege	3068	explorer.exe

Suspicious use of FindShellTrayWindow 28 IoCs

Processes:

explorer.exe

pid	process
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

explorer.exe

pid	process
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe
3068	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

dc97ae4dbd3d7610c97a1e8ea826b5c3.exeR07924.exedlmij.exedehost.exe

pid process

2888 dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
2608 R07924.exe
1972 dlmij.exe
2948 dehost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

dc97ae4dbd3d7610c97a1e8ea826b5c3.exedc97ae4dbd3d7610c97a1e8ea826b5c3.exeR07924.execmd.exeaehost.execehost.exebehost.exe

description	pid	process	target process
PID 3036 wrote to memory of 2888	3036	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
PID 3036 wrote to memory of 2888	3036	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
PID 3036 wrote to memory of 2888	3036	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
PID 3036 wrote to memory of 2888	3036	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
PID 3036 wrote to memory of 2888	3036	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
PID 3036 wrote to memory of 2888	3036	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
PID 3036 wrote to memory of 2888	3036	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
PID 3036 wrote to memory of 2888	3036	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
PID 2888 wrote to memory of 2608	2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	R07924.exe
PID 2888 wrote to memory of 2608	2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	R07924.exe
PID 2888 wrote to memory of 2608	2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	R07924.exe
PID 2888 wrote to memory of 2608	2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	R07924.exe
PID 2608 wrote to memory of 1972	2608	R07924.exe	dlmij.exe
PID 2608 wrote to memory of 1972	2608	R07924.exe	dlmij.exe
PID 2608 wrote to memory of 1972	2608	R07924.exe	dlmij.exe
PID 2608 wrote to memory of 1972	2608	R07924.exe	dlmij.exe
PID 2608 wrote to memory of 2544	2608	R07924.exe	cmd.exe
PID 2608 wrote to memory of 2544	2608	R07924.exe	cmd.exe
PID 2608 wrote to memory of 2544	2608	R07924.exe	cmd.exe
PID 2608 wrote to memory of 2544	2608	R07924.exe	cmd.exe
PID 2544 wrote to memory of 2380	2544	cmd.exe	tasklist.exe
PID 2544 wrote to memory of 2380	2544	cmd.exe	tasklist.exe
PID 2544 wrote to memory of 2380	2544	cmd.exe	tasklist.exe
PID 2544 wrote to memory of 2380	2544	cmd.exe	tasklist.exe
PID 2888 wrote to memory of 2832	2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	aehost.exe
PID 2888 wrote to memory of 2832	2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	aehost.exe
PID 2888 wrote to memory of 2832	2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	aehost.exe
PID 2888 wrote to memory of 2832	2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	aehost.exe
PID 2832 wrote to memory of 1524	2832	aehost.exe	aehost.exe
PID 2832 wrote to memory of 1524	2832	aehost.exe	aehost.exe
PID 2832 wrote to memory of 1524	2832	aehost.exe	aehost.exe
PID 2832 wrote to memory of 1524	2832	aehost.exe	aehost.exe
PID 2832 wrote to memory of 1524	2832	aehost.exe	aehost.exe
PID 2832 wrote to memory of 1524	2832	aehost.exe	aehost.exe
PID 2832 wrote to memory of 1524	2832	aehost.exe	aehost.exe
PID 2832 wrote to memory of 1524	2832	aehost.exe	aehost.exe
PID 2832 wrote to memory of 1524	2832	aehost.exe	aehost.exe
PID 2832 wrote to memory of 1524	2832	aehost.exe	aehost.exe
PID 2832 wrote to memory of 1524	2832	aehost.exe	aehost.exe
PID 2888 wrote to memory of 1564	2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	behost.exe
PID 2888 wrote to memory of 1564	2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	behost.exe
PID 2888 wrote to memory of 1564	2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	behost.exe
PID 2888 wrote to memory of 1564	2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	behost.exe
PID 2888 wrote to memory of 2472	2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	cehost.exe
PID 2888 wrote to memory of 2472	2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	cehost.exe
PID 2888 wrote to memory of 2472	2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	cehost.exe
PID 2888 wrote to memory of 2472	2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	cehost.exe
PID 2472 wrote to memory of 1408	2472	cehost.exe	explorer.exe
PID 2472 wrote to memory of 1408	2472	cehost.exe	explorer.exe
PID 2472 wrote to memory of 1408	2472	cehost.exe	explorer.exe
PID 2472 wrote to memory of 1408	2472	cehost.exe	explorer.exe
PID 2472 wrote to memory of 1408	2472	cehost.exe	explorer.exe
PID 2888 wrote to memory of 2948	2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dehost.exe
PID 2888 wrote to memory of 2948	2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dehost.exe
PID 2888 wrote to memory of 2948	2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dehost.exe
PID 2888 wrote to memory of 2948	2888	dc97ae4dbd3d7610c97a1e8ea826b5c3.exe	dehost.exe
PID 1564 wrote to memory of 664	1564	behost.exe	behost.exe
PID 1564 wrote to memory of 664	1564	behost.exe	behost.exe
PID 1564 wrote to memory of 664	1564	behost.exe	behost.exe
PID 1564 wrote to memory of 664	1564	behost.exe	behost.exe
PID 1564 wrote to memory of 2536	1564	behost.exe	behost.exe
PID 1564 wrote to memory of 2536	1564	behost.exe	behost.exe
PID 1564 wrote to memory of 2536	1564	behost.exe	behost.exe
PID 1564 wrote to memory of 2536	1564	behost.exe	behost.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

behost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	behost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	behost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
"C:\Users\Admin\AppData\Local\Temp\dc97ae4dbd3d7610c97a1e8ea826b5c3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3036

C:\Users\Admin\AppData\Local\Temp\dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888

C:\Users\Admin\R07924.exe
C:\Users\Admin\R07924.exe
3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608

C:\Users\Admin\dlmij.exe
"C:\Users\Admin\dlmij.exe"
4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1972

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c tasklist&&del R07924.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2544

C:\Windows\SysWOW64\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Users\Admin\aehost.exe
C:\Users\Admin\aehost.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2832

C:\Users\Admin\aehost.exe
aehost.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1524

C:\Users\Admin\behost.exe
C:\Users\Admin\behost.exe
3⤵
- Modifies security service
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1564

C:\Users\Admin\behost.exe
C:\Users\Admin\behost.exe startC:\Users\Admin\AppData\Roaming\307AA\75ED3.exe%C:\Users\Admin\AppData\Roaming\307AA
4⤵
- Executes dropped EXE
PID:664

C:\Users\Admin\behost.exe
C:\Users\Admin\behost.exe startC:\Program Files (x86)\AAF8B\lvvm.exe%C:\Program Files (x86)\AAF8B
4⤵
- Executes dropped EXE
PID:2536

C:\Program Files (x86)\LP\D3A3\EED2.tmp
"C:\Program Files (x86)\LP\D3A3\EED2.tmp"
4⤵
- Executes dropped EXE
PID:544

C:\Users\Admin\cehost.exe
C:\Users\Admin\cehost.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2472

C:\Windows\explorer.exe
000000C0*
4⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Users\Admin\dehost.exe
C:\Users\Admin\dehost.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2948

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c tasklist&&del dc97ae4dbd3d7610c97a1e8ea826b5c3.exe
3⤵
- Deletes itself
PID:2084

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1808

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2372

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3068

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Process Discovery

T1057

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\307AA\AF8B.07A
Filesize
600B

MD5
e8041c5eeaab7349de22ab43c27cac13

SHA1
17f5d9f6a8489eaea403b86dc10025b8caceaeaf

SHA256
5cb323307fc1d78a527d8d58b21d71e82ca5843f7c6faca78364710e25c122ab

SHA512
9f25fb770cb80912c42a4ac0fab9d480dbd2bb4cffbb9e473eed70d963202583831c12f612fcc7a6b9a0dbf33ec6b46604f25da54dbfb181e89de4997a894cef

Download Submit
C:\Users\Admin\AppData\Roaming\307AA\AF8B.07A
Filesize
996B

MD5
0f67fced6377a072b9444a0d6b3c757e

SHA1
c8683b001171dc494638a269392b1a6142a13150

SHA256
daa7c96ed51b2c5a79cdc15c246750730b3757602534d1a794544e3775d306ac

SHA512
ad2d9e0af40807ca59b6f09fd1430a010c7566f7108135d82aed49887e18c6ab519c707c72c4742af45d8f4db1c251e6cf6e06897e782031eb26c5956c5ff25e

Download Submit
C:\Users\Admin\AppData\Roaming\307AA\AF8B.07A
Filesize
1KB

MD5
6863a4222c2e0a33d55179863a0dc64a

SHA1
dda63265295502605d172645cd1db56a3439af91

SHA256
e086b66b28f2fe29ff5600ab5dff8fdb16fd7e26fc5fe57cf493b666e85a91cb

SHA512
d9fd415f16845d999d08e7d5bf28691929777d7d91bcafa1725a03e7284e079f05caae372e8572fe6233e9f332918087ba0d2908d489539178f8b362a6a51b32

Download Submit
C:\Users\Admin\AppData\Roaming\307AA\AF8B.07A
Filesize
1KB

MD5
cfb6e82060a964f17abb61ed15ce3b57

SHA1
59f09f599d9e42f62e70aabe66dedfffbadbe715

SHA256
305acbed2c5952d26021626b13e2bd67b97dcd61e1f7e05674ae4ce4cded0d87

SHA512
1badea200f891e35417532827e87dc88acbd25eacbb1b3c812dc9735e29fcf98d17197bf98da54fb73b1226adf5908672c0269469b8efbb25dd4766bf7a6a6c6

Download Submit
\Program Files (x86)\LP\D3A3\EED2.tmp
Filesize
104KB

MD5
0cb09d0443d2eda312058ae1a2fa83c2

SHA1
1888844fcab4269a5c08b5cf122b100e8abb3cb0

SHA256
50a9af2fe05dd06d6ff825bcf2106b64385e7fdf9a06a0a18ac187c4a057503a

SHA512
93bfdc4d14a7ba7cce25d0a83faa29e0efa7932f3024aa82fcc1d606cb9a65e0ebd91942ad9992ce787f639df1748fde9599cb9b676245a17a8198064df2e24c

Download Submit
\Users\Admin\R07924.exe
Filesize
188KB

MD5
4f9c5823c5d1255ded151b01c0a58e15

SHA1
2f7018a9211472ddfa5d2f09629bf90adce4676c

SHA256
e38564871dc5952e2d1d22d51e312e3064cf84df95c0420021153cb5c264adcf

SHA512
b5518effbf476d9486a5ddaa65c937e97b10470d533f8e0c9af30956868c032f6bdb524d13a004e4a0d19e9a88b5f3f11ee82e5602b1175092fb36a9959d40ca

Download Submit
\Users\Admin\aehost.exe
Filesize
129KB

MD5
e2b1704acdf48221cd9be91bae3546c5

SHA1
f53a59b62276f58cf8689768f747e16f53dbd341

SHA256
8b1c13bb2e95f71ed75d8fca7aeefc556ecd377d5d4f6c544d77ac8f74255ca5

SHA512
1b3d8baa981851a79c4f12f3ea2a4d197b3439e76ca723acd578acabd731310d6eeb3a4567a10d48f45192ae9c4cd732eca04c0a7fffa636e7bd364ed1357b53

Download Submit
\Users\Admin\behost.exe
Filesize
279KB

MD5
2a583120a51178ee5f8bc2727faaa73e

SHA1
91296d42eeddb285aeea28f5139cadda10f21df7

SHA256
b315e97fff3561563da4dcf7283636f42eef9ebaf422506e01f03716d4877b02

SHA512
003e11b916256091486311881a06286d532a9940d75977a44afa3c116277a0f490505e9b4053f56846fb6d1d7584d7748f622bc9cae088af93820452027dac8b

Download Submit
\Users\Admin\cehost.exe
Filesize
145KB

MD5
56be9270582de0986c72139ea218e121

SHA1
d33b8a2127ccf6b6f42a0c0f266136a376def18c

SHA256
8b40a882fde5ef3df2ec3112142b654c949adf7f559bc1912ad9d08ebb17c257

SHA512
dcee7d3d16e19e5a36a386d097c171ed7761ad4fc626b5d523b9c33f952fa24da733c56fcb8ff440894c3672c468d04cecc001ae9a680a9607347a5f517e6023

Download Submit
\Users\Admin\dehost.exe
Filesize
24KB

MD5
7cda5863b933988b7bd1d0c8035dafd9

SHA1
68c64d655d0df1c9974587d12b3b88f5ce1f4cac

SHA256
400cb530f1489c46ada1dedc35b51cb53e8174f5cdda0d086ef593c135e0f216

SHA512
978440c09b70b695fdc171c6e2a7c064aa078d4a300db7f297afde5e3c1cfdf513da01dae967a9a8c524c185432ef87bf922a5cc97a9c8a6d1fd9cc3155e0aea

Download Submit
\Users\Admin\dlmij.exe
Filesize
188KB

MD5
44b66204d1649ff96639c12c480d4b91

SHA1
aedda1307184f1a7d90e3d07afc3a577be5d52ad

SHA256
caba78989842f360f9586487f3cf9edf6b1ffa05179cf56b252dfdb7edb1438f

SHA512
38506e8c8e146de7872df53b1d8782bbfc8429d457eafa71b614634af3c60d16f0432e78ebd502427f0be1cba8260650f36f56fb7a3ddc16437210404c6cadf3

Download Submit
memory/544-299-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/544-300-0x0000000000550000-0x0000000000650000-memory.dmp

Filesize
1024KB

Download
memory/544-337-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/664-136-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/664-137-0x0000000002090000-0x00000000020D7000-memory.dmp

Filesize
284KB

Download
memory/1408-103-0x00000000002F0000-0x0000000000309000-memory.dmp

Filesize
100KB

Download
memory/1408-101-0x0000000000060000-0x0000000000075000-memory.dmp

Filesize
84KB

Download
memory/1408-109-0x00000000002F0000-0x0000000000309000-memory.dmp

Filesize
100KB

Download
memory/1408-114-0x00000000002F0000-0x0000000000309000-memory.dmp

Filesize
100KB

Download
memory/1524-53-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1524-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1524-75-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1524-67-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1524-64-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1524-61-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1524-58-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1524-55-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1524-51-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1564-142-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1564-211-0x00000000020D0000-0x00000000021D0000-memory.dmp

Filesize
1024KB

Download
memory/1564-210-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1564-85-0x00000000020D0000-0x00000000021D0000-memory.dmp

Filesize
1024KB

Download
memory/1564-84-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2472-97-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2472-99-0x0000000001D00000-0x0000000001D42000-memory.dmp

Filesize
264KB

Download
memory/2472-96-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2472-100-0x0000000001D01000-0x0000000001D02000-memory.dmp

Filesize
4KB

Download
memory/2472-102-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2536-207-0x0000000002170000-0x00000000021B7000-memory.dmp

Filesize
284KB

Download
memory/2536-206-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2832-71-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2888-12-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/2888-3-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/2888-49-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/2888-94-0x0000000000250000-0x0000000000292000-memory.dmp

Filesize
264KB

Download
memory/2888-95-0x0000000000250000-0x0000000000292000-memory.dmp

Filesize
264KB

Download
memory/2888-13-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/2888-11-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/2888-0-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/2888-5-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/2888-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2888-2-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/2888-335-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3036-9-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3068-338-0x0000000004700000-0x0000000004701000-memory.dmp

Filesize
4KB

Download
memory/3068-344-0x0000000004700000-0x0000000004701000-memory.dmp

Filesize
4KB

Download