pony | 43d6247a06e4d2a6ccda3a25b2a82955f4823fa55727ae55af15f4571dcf4832

Analysis

max time kernel
105s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

231926684e4a26617b922bbab5754fef_JaffaCakes118.exe
Size

2.2MB
MD5

231926684e4a26617b922bbab5754fef
SHA1

6bd9c989923687f5f93940018c13de17329f8501
SHA256

43d6247a06e4d2a6ccda3a25b2a82955f4823fa55727ae55af15f4571dcf4832
SHA512

3df5bb2a61a8ebec773300a1a3b97f96bcae03498d012b348fa4cf16c9408d5149fbd4bab2b3d56ac981923c0ed61ef34b9aa45381efb36cf539714c4853163c
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZt:0UzeyQMS4DqodCnoe+iitjWwwp

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\231926684e4a26617b922bbab5754fef_JaffaCakes118.exe	231926684e4a26617b922bbab5754fef_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\231926684e4a26617b922bbab5754fef_JaffaCakes118.exe	231926684e4a26617b922bbab5754fef_JaffaCakes118.exe

Executes dropped EXE 59 IoCs

pid	Process
2912	explorer.exe
4452	explorer.exe
4480	spoolsv.exe
2256	spoolsv.exe
1672	spoolsv.exe
2024	spoolsv.exe
2088	spoolsv.exe
3792	spoolsv.exe
4272	spoolsv.exe
4424	spoolsv.exe
216	spoolsv.exe
4788	spoolsv.exe
1384	spoolsv.exe
400	spoolsv.exe
2236	spoolsv.exe
1952	spoolsv.exe
1644	spoolsv.exe
2348	spoolsv.exe
4948	spoolsv.exe
1904	spoolsv.exe
2840	spoolsv.exe
3300	spoolsv.exe
4304	spoolsv.exe
5028	spoolsv.exe
1300	spoolsv.exe
2456	spoolsv.exe
2864	spoolsv.exe
5016	explorer.exe
4152	spoolsv.exe
2572	spoolsv.exe
5056	spoolsv.exe
1192	explorer.exe
2792	spoolsv.exe
4184	spoolsv.exe
3352	spoolsv.exe
1516	spoolsv.exe
2612	spoolsv.exe
2116	explorer.exe
532	spoolsv.exe
2416	spoolsv.exe
4552	explorer.exe
3936	spoolsv.exe
1960	spoolsv.exe
2212	spoolsv.exe
708	explorer.exe
3372	spoolsv.exe
4288	spoolsv.exe
1768	explorer.exe
2904	spoolsv.exe
3520	spoolsv.exe
3964	spoolsv.exe
968	spoolsv.exe
4896	explorer.exe
4528	spoolsv.exe
3980	spoolsv.exe
4572	spoolsv.exe
3352	explorer.exe
2412	spoolsv.exe
2880	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 17 IoCs

description	pid	Process	procid_target
PID 1636 set thread context of 4488	1636	231926684e4a26617b922bbab5754fef_JaffaCakes118.exe	103
PID 2912 set thread context of 4452	2912	explorer.exe	109
PID 4480 set thread context of 2864	4480	spoolsv.exe	135
PID 2256 set thread context of 4152	2256	spoolsv.exe	137
PID 1672 set thread context of 5056	1672	spoolsv.exe	139
PID 2024 set thread context of 2792	2024	spoolsv.exe	141
PID 2088 set thread context of 4184	2088	spoolsv.exe	142
PID 3792 set thread context of 3352	3792	spoolsv.exe	143
PID 4272 set thread context of 2612	4272	spoolsv.exe	145
PID 4424 set thread context of 2416	4424	spoolsv.exe	148
PID 216 set thread context of 2212	216	spoolsv.exe	152
PID 4788 set thread context of 4288	4788	spoolsv.exe	155
PID 1384 set thread context of 3520	1384	spoolsv.exe	159
PID 400 set thread context of 968	400	spoolsv.exe	161
PID 2236 set thread context of 4528	2236	spoolsv.exe	163
PID 1952 set thread context of 4572	1952	spoolsv.exe	165
PID 1644 set thread context of 2880	1644	spoolsv.exe	168

Drops file in Windows directory 46 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	231926684e4a26617b922bbab5754fef_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	231926684e4a26617b922bbab5754fef_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4488	231926684e4a26617b922bbab5754fef_JaffaCakes118.exe
4488	231926684e4a26617b922bbab5754fef_JaffaCakes118.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
4488	231926684e4a26617b922bbab5754fef_JaffaCakes118.exe
4488	231926684e4a26617b922bbab5754fef_JaffaCakes118.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
4452	explorer.exe
2864	spoolsv.exe
2864	spoolsv.exe
4152	spoolsv.exe
4152	spoolsv.exe
5056	spoolsv.exe
5056	spoolsv.exe
2792	spoolsv.exe
2792	spoolsv.exe
4184	spoolsv.exe
4184	spoolsv.exe
3352	spoolsv.exe
3352	spoolsv.exe
2612	spoolsv.exe
2612	spoolsv.exe
2416	spoolsv.exe
2416	spoolsv.exe
2212	spoolsv.exe
2212	spoolsv.exe
4288	spoolsv.exe
4288	spoolsv.exe
3520	spoolsv.exe
3520	spoolsv.exe
968	spoolsv.exe
968	spoolsv.exe
4528	spoolsv.exe
4528	spoolsv.exe
4572	spoolsv.exe
4572	spoolsv.exe
2880	spoolsv.exe
2880	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1240	1636	231926684e4a26617b922bbab5754fef_JaffaCakes118.exe	83
PID 1636 wrote to memory of 1240	1636	231926684e4a26617b922bbab5754fef_JaffaCakes118.exe	83
PID 1636 wrote to memory of 4488	1636	231926684e4a26617b922bbab5754fef_JaffaCakes118.exe	103
PID 1636 wrote to memory of 4488	1636	231926684e4a26617b922bbab5754fef_JaffaCakes118.exe	103
PID 1636 wrote to memory of 4488	1636	231926684e4a26617b922bbab5754fef_JaffaCakes118.exe	103
PID 1636 wrote to memory of 4488	1636	231926684e4a26617b922bbab5754fef_JaffaCakes118.exe	103
PID 1636 wrote to memory of 4488	1636	231926684e4a26617b922bbab5754fef_JaffaCakes118.exe	103
PID 4488 wrote to memory of 2912	4488	231926684e4a26617b922bbab5754fef_JaffaCakes118.exe	104
PID 4488 wrote to memory of 2912	4488	231926684e4a26617b922bbab5754fef_JaffaCakes118.exe	104
PID 4488 wrote to memory of 2912	4488	231926684e4a26617b922bbab5754fef_JaffaCakes118.exe	104
PID 2912 wrote to memory of 4452	2912	explorer.exe	109
PID 2912 wrote to memory of 4452	2912	explorer.exe	109
PID 2912 wrote to memory of 4452	2912	explorer.exe	109
PID 2912 wrote to memory of 4452	2912	explorer.exe	109
PID 2912 wrote to memory of 4452	2912	explorer.exe	109
PID 4452 wrote to memory of 4480	4452	explorer.exe	110
PID 4452 wrote to memory of 4480	4452	explorer.exe	110
PID 4452 wrote to memory of 4480	4452	explorer.exe	110
PID 4452 wrote to memory of 2256	4452	explorer.exe	111
PID 4452 wrote to memory of 2256	4452	explorer.exe	111
PID 4452 wrote to memory of 2256	4452	explorer.exe	111
PID 4452 wrote to memory of 1672	4452	explorer.exe	112
PID 4452 wrote to memory of 1672	4452	explorer.exe	112
PID 4452 wrote to memory of 1672	4452	explorer.exe	112
PID 4452 wrote to memory of 2024	4452	explorer.exe	113
PID 4452 wrote to memory of 2024	4452	explorer.exe	113
PID 4452 wrote to memory of 2024	4452	explorer.exe	113
PID 4452 wrote to memory of 2088	4452	explorer.exe	115
PID 4452 wrote to memory of 2088	4452	explorer.exe	115
PID 4452 wrote to memory of 2088	4452	explorer.exe	115
PID 4452 wrote to memory of 3792	4452	explorer.exe	116
PID 4452 wrote to memory of 3792	4452	explorer.exe	116
PID 4452 wrote to memory of 3792	4452	explorer.exe	116
PID 4452 wrote to memory of 4272	4452	explorer.exe	117
PID 4452 wrote to memory of 4272	4452	explorer.exe	117
PID 4452 wrote to memory of 4272	4452	explorer.exe	117
PID 4452 wrote to memory of 4424	4452	explorer.exe	118
PID 4452 wrote to memory of 4424	4452	explorer.exe	118
PID 4452 wrote to memory of 4424	4452	explorer.exe	118
PID 4452 wrote to memory of 216	4452	explorer.exe	119
PID 4452 wrote to memory of 216	4452	explorer.exe	119
PID 4452 wrote to memory of 216	4452	explorer.exe	119
PID 4452 wrote to memory of 4788	4452	explorer.exe	120
PID 4452 wrote to memory of 4788	4452	explorer.exe	120
PID 4452 wrote to memory of 4788	4452	explorer.exe	120
PID 4452 wrote to memory of 1384	4452	explorer.exe	121
PID 4452 wrote to memory of 1384	4452	explorer.exe	121
PID 4452 wrote to memory of 1384	4452	explorer.exe	121
PID 4452 wrote to memory of 400	4452	explorer.exe	122
PID 4452 wrote to memory of 400	4452	explorer.exe	122
PID 4452 wrote to memory of 400	4452	explorer.exe	122
PID 4452 wrote to memory of 2236	4452	explorer.exe	123
PID 4452 wrote to memory of 2236	4452	explorer.exe	123
PID 4452 wrote to memory of 2236	4452	explorer.exe	123
PID 4452 wrote to memory of 1952	4452	explorer.exe	124
PID 4452 wrote to memory of 1952	4452	explorer.exe	124
PID 4452 wrote to memory of 1952	4452	explorer.exe	124
PID 4452 wrote to memory of 1644	4452	explorer.exe	125
PID 4452 wrote to memory of 1644	4452	explorer.exe	125
PID 4452 wrote to memory of 1644	4452	explorer.exe	125
PID 4452 wrote to memory of 2348	4452	explorer.exe	126
PID 4452 wrote to memory of 2348	4452	explorer.exe	126
PID 4452 wrote to memory of 2348	4452	explorer.exe	126
PID 4452 wrote to memory of 4948	4452	explorer.exe	127

C:\Users\Admin\AppData\Local\Temp\231926684e4a26617b922bbab5754fef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\231926684e4a26617b922bbab5754fef_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1240
- C:\Users\Admin\AppData\Local\Temp\231926684e4a26617b922bbab5754fef_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\231926684e4a26617b922bbab5754fef_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4488
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4480
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2864
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5016
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1672
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5056
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1192
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2024
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4272
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2612
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2116
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2416
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4552
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2212
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:708
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4788
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4288
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1768
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1384
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:968
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4896
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2236
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4572
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3352
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2348
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3688
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2608
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:6100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4948
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3004
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5092
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3300
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:764
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3204
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:932
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2328
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1300
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2376
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3420
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5304
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1516
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:532
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1960
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3372
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:548
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4724
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3980
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2412
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5968
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:6036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4968
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3664
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5564
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2384
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4604
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5144
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1852
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:8
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3532
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5824
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
5013fd1aabeb99ba5df059bbecb6b932

SHA1
e5ff9f021d76a82971103151d63b2bb187ca4a26

SHA256
e80ac8c5ce66de1328db241d975bc01cf54e352efaade054a66645846343b83e

SHA512
86380fdfa60e2dd9500cff5607ddeadff8d395578dc13a4b84ab417014bc1428bcb50a7940000eca80e434d2734c54e8fef1bd00998fb51322d90b740d86d6ae

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
498a4c431b4cef16f9dd9ada857c0e6b

SHA1
30c730d4c8f38a6765cfeafb589cfe629c7fedf8

SHA256
c769cc1928b2fcf4e0bd7ed82e97b63f8510d73901d845f254e28748d558dea1

SHA512
b09c50ed62eacc450eb3d45de0b0872352bbba7165f522441839c7c47d3d826b695afc7fb85516c16f77de7bf399a95cfaa68793b302b52d7e1f67b103ddcc09

Download Submit
memory/8-5186-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/8-5065-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/216-1065-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/400-1361-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/548-4160-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/548-4279-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/764-3469-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/920-4411-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/932-3626-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/932-3486-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/968-2564-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/968-2682-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1216-4401-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1368-4210-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1368-4203-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1384-1197-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1636-33-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/1636-37-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1636-31-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1636-0-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/1644-1552-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1672-716-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1672-1705-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1904-1715-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1952-1550-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1964-3350-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2024-833-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2024-1713-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2088-834-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2212-2302-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2212-2195-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2236-1362-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2256-1629-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2256-715-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2348-1626-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2376-3651-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2376-3778-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2416-2114-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2612-1982-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2612-1884-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2792-1716-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2864-1553-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2864-1689-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2880-2786-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2912-75-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2912-70-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3004-3253-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3004-3098-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3016-3661-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3036-4152-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3096-5080-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3096-5083-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3352-1736-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3436-4171-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3512-2936-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3688-2884-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3760-5153-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3760-5151-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3792-835-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3888-4835-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4080-3190-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4152-1627-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4152-1628-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/4152-1631-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4184-1723-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4184-1727-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4272-946-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4288-2451-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4288-2322-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4336-3547-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4424-947-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4452-74-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4452-615-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4480-1551-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4480-616-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4488-36-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4488-34-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4488-64-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4572-2701-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4604-4986-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4604-4826-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4724-4381-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4788-1196-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4948-1706-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5056-1707-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5056-1862-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5152-5074-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5304-3921-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5304-4134-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5308-4748-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5308-4751-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5384-4391-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5400-3931-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5440-4684-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5540-3951-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5564-4675-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5564-4804-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5624-4973-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5668-3970-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5668-3967-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5732-3980-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5824-5609-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5968-4530-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6100-4545-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download