pony | dc1e8e74460a14e403b9062262fde733da9b34dd35f70bd7b205dae31b1ea601

Analysis

max time kernel
111s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 23:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe
Size 2.2MB
Sample240612-3lc5jayfqk
SHA256 dc1e8e74460a14e403b9062262fde733da9b34dd35f70bd7b205dae31b1ea601
MD5 a2f4c888f59553fb2fc14671ec2b25f3
SHA1 41032f48621b418e4cdd1facc388e20b1c0148f8
SHA512 b6ea17588bae2c4eb7fe256b677cbcb3036565469fa7b713d4f60d7f24f5a2dac34f479313e4655db6698e8d086629076a02493c8c17899f6473f22cb7ae5707
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZo:0UzeyQMS4DqodCnoe+iitjWwwU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe	a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe	a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
336	explorer.exe
224	explorer.exe
3920	spoolsv.exe
1236	spoolsv.exe
1456	spoolsv.exe
4948	spoolsv.exe
2232	spoolsv.exe
2412	spoolsv.exe
5016	spoolsv.exe
4768	spoolsv.exe
3960	spoolsv.exe
3220	spoolsv.exe
3964	spoolsv.exe
3264	spoolsv.exe
4976	spoolsv.exe
4632	spoolsv.exe
3572	spoolsv.exe
4200	spoolsv.exe
3536	spoolsv.exe
4224	spoolsv.exe
2556	spoolsv.exe
1400	spoolsv.exe
3640	spoolsv.exe
640	spoolsv.exe
2056	spoolsv.exe
3392	spoolsv.exe
2828	spoolsv.exe
1972	explorer.exe
4284	spoolsv.exe
2544	spoolsv.exe
2384	explorer.exe
1800	spoolsv.exe
1980	spoolsv.exe
116	spoolsv.exe
4484	spoolsv.exe
1640	explorer.exe
1692	spoolsv.exe
4760	spoolsv.exe
4236	spoolsv.exe
4348	explorer.exe
1636	spoolsv.exe
3120	spoolsv.exe
3516	spoolsv.exe
4524	spoolsv.exe
1808	explorer.exe
2204	spoolsv.exe
4804	spoolsv.exe
1664	spoolsv.exe
2516	explorer.exe
3500	spoolsv.exe
3984	spoolsv.exe
2164	spoolsv.exe
4336	spoolsv.exe
2108	explorer.exe
2604	spoolsv.exe
4400	spoolsv.exe
3976	spoolsv.exe
944	explorer.exe
4296	spoolsv.exe
1768	spoolsv.exe
2832	spoolsv.exe
4624	spoolsv.exe
4760	explorer.exe
1096	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 23 IoCs

description	pid	Process	procid_target
PID 4796 set thread context of 844	4796	a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe	87
PID 336 set thread context of 224	336	explorer.exe	92
PID 3920 set thread context of 2828	3920	spoolsv.exe	117
PID 1236 set thread context of 2544	1236	spoolsv.exe	120
PID 1456 set thread context of 1800	1456	spoolsv.exe	122
PID 4948 set thread context of 116	4948	spoolsv.exe	124
PID 2232 set thread context of 4484	2232	spoolsv.exe	125
PID 2412 set thread context of 4760	2412	spoolsv.exe	128
PID 5016 set thread context of 4236	5016	spoolsv.exe	129
PID 4768 set thread context of 3120	4768	spoolsv.exe	132
PID 3960 set thread context of 4524	3960	spoolsv.exe	134
PID 3220 set thread context of 2204	3220	spoolsv.exe	136
PID 3964 set thread context of 1664	3964	spoolsv.exe	138
PID 3264 set thread context of 3984	3264	spoolsv.exe	141
PID 4976 set thread context of 4336	4976	spoolsv.exe	143
PID 4632 set thread context of 4400	4632	spoolsv.exe	146
PID 3572 set thread context of 3976	3572	spoolsv.exe	147
PID 4200 set thread context of 1768	4200	spoolsv.exe	150
PID 3536 set thread context of 4624	3536	spoolsv.exe	152
PID 4224 set thread context of 1096	4224	spoolsv.exe	154
PID 2556 set thread context of 4720	2556	spoolsv.exe	156
PID 1400 set thread context of 4888	1400	spoolsv.exe	159
PID 3640 set thread context of 4268	3640	spoolsv.exe	160

Drops file in Windows directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
844	a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe
844	a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe

Suspicious use of SetWindowsHookEx 48 IoCs

pid	Process
844	a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe
844	a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
224	explorer.exe
2828	spoolsv.exe
2828	spoolsv.exe
2544	spoolsv.exe
2544	spoolsv.exe
1800	spoolsv.exe
1800	spoolsv.exe
116	spoolsv.exe
116	spoolsv.exe
4484	spoolsv.exe
4484	spoolsv.exe
4760	spoolsv.exe
4760	spoolsv.exe
4236	spoolsv.exe
4236	spoolsv.exe
3120	spoolsv.exe
3120	spoolsv.exe
4524	spoolsv.exe
4524	spoolsv.exe
2204	spoolsv.exe
2204	spoolsv.exe
1664	spoolsv.exe
1664	spoolsv.exe
3984	spoolsv.exe
3984	spoolsv.exe
4336	spoolsv.exe
4336	spoolsv.exe
4400	spoolsv.exe
4400	spoolsv.exe
3976	spoolsv.exe
3976	spoolsv.exe
1768	spoolsv.exe
1768	spoolsv.exe
4624	spoolsv.exe
4624	spoolsv.exe
1096	spoolsv.exe
1096	spoolsv.exe
4720	spoolsv.exe
4720	spoolsv.exe
4888	spoolsv.exe
4888	spoolsv.exe
4268	spoolsv.exe
4268	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 3820	4796	a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe	82
PID 4796 wrote to memory of 3820	4796	a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe	82
PID 4796 wrote to memory of 844	4796	a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe	87
PID 4796 wrote to memory of 844	4796	a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe	87
PID 4796 wrote to memory of 844	4796	a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe	87
PID 4796 wrote to memory of 844	4796	a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe	87
PID 4796 wrote to memory of 844	4796	a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe	87
PID 844 wrote to memory of 336	844	a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe	88
PID 844 wrote to memory of 336	844	a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe	88
PID 844 wrote to memory of 336	844	a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe	88
PID 336 wrote to memory of 224	336	explorer.exe	92
PID 336 wrote to memory of 224	336	explorer.exe	92
PID 336 wrote to memory of 224	336	explorer.exe	92
PID 336 wrote to memory of 224	336	explorer.exe	92
PID 336 wrote to memory of 224	336	explorer.exe	92
PID 224 wrote to memory of 3920	224	explorer.exe	93
PID 224 wrote to memory of 3920	224	explorer.exe	93
PID 224 wrote to memory of 3920	224	explorer.exe	93
PID 224 wrote to memory of 1236	224	explorer.exe	94
PID 224 wrote to memory of 1236	224	explorer.exe	94
PID 224 wrote to memory of 1236	224	explorer.exe	94
PID 224 wrote to memory of 1456	224	explorer.exe	95
PID 224 wrote to memory of 1456	224	explorer.exe	95
PID 224 wrote to memory of 1456	224	explorer.exe	95
PID 224 wrote to memory of 4948	224	explorer.exe	96
PID 224 wrote to memory of 4948	224	explorer.exe	96
PID 224 wrote to memory of 4948	224	explorer.exe	96
PID 224 wrote to memory of 2232	224	explorer.exe	97
PID 224 wrote to memory of 2232	224	explorer.exe	97
PID 224 wrote to memory of 2232	224	explorer.exe	97
PID 224 wrote to memory of 2412	224	explorer.exe	98
PID 224 wrote to memory of 2412	224	explorer.exe	98
PID 224 wrote to memory of 2412	224	explorer.exe	98
PID 224 wrote to memory of 5016	224	explorer.exe	99
PID 224 wrote to memory of 5016	224	explorer.exe	99
PID 224 wrote to memory of 5016	224	explorer.exe	99
PID 224 wrote to memory of 4768	224	explorer.exe	100
PID 224 wrote to memory of 4768	224	explorer.exe	100
PID 224 wrote to memory of 4768	224	explorer.exe	100
PID 224 wrote to memory of 3960	224	explorer.exe	101
PID 224 wrote to memory of 3960	224	explorer.exe	101
PID 224 wrote to memory of 3960	224	explorer.exe	101
PID 224 wrote to memory of 3220	224	explorer.exe	102
PID 224 wrote to memory of 3220	224	explorer.exe	102
PID 224 wrote to memory of 3220	224	explorer.exe	102
PID 224 wrote to memory of 3964	224	explorer.exe	103
PID 224 wrote to memory of 3964	224	explorer.exe	103
PID 224 wrote to memory of 3964	224	explorer.exe	103
PID 224 wrote to memory of 3264	224	explorer.exe	104
PID 224 wrote to memory of 3264	224	explorer.exe	104
PID 224 wrote to memory of 3264	224	explorer.exe	104
PID 224 wrote to memory of 4976	224	explorer.exe	105
PID 224 wrote to memory of 4976	224	explorer.exe	105
PID 224 wrote to memory of 4976	224	explorer.exe	105
PID 224 wrote to memory of 4632	224	explorer.exe	106
PID 224 wrote to memory of 4632	224	explorer.exe	106
PID 224 wrote to memory of 4632	224	explorer.exe	106
PID 224 wrote to memory of 3572	224	explorer.exe	107
PID 224 wrote to memory of 3572	224	explorer.exe	107
PID 224 wrote to memory of 3572	224	explorer.exe	107
PID 224 wrote to memory of 4200	224	explorer.exe	108
PID 224 wrote to memory of 4200	224	explorer.exe	108
PID 224 wrote to memory of 4200	224	explorer.exe	108
PID 224 wrote to memory of 3536	224	explorer.exe	109

C:\Users\Admin\AppData\Local\Temp\a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3820
- C:\Users\Admin\AppData\Local\Temp\a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a2f4c888f59553fb2fc14671ec2b25f3_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:844
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:336
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2828
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1972
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1236
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2544
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2384
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4948
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2232
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4484
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1640
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2412
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4236
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4348
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3960
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4524
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1808
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2204
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2516
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3264
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4976
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4336
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2108
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4632
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3976
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:944
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4200
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3536
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4624
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4760
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4224
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2556
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4720
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2904
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4268
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:748
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4548
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2592
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4284
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2796
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2324
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1980
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1392
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1784
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1636
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:976
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3516
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2224
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3500
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2604
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:496
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4296
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1948
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:980
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3932
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4172
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3972
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3956
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2476
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4476
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4996
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 e59829fefc38509aec7eee248aa097333664afe690623334ac521637e0dfd7eb
MD5 99022d58b69e736f349588e224390105
SHA1 6278f77924abd8fbed0ad7beb9ff63a46bdf652f
SHA512 0f55f5c7fca3be142276f6d7ef2be3188d5df963910716a081f4fb03395a4fd7eda5d7b5dd94d3870fd67dbce902d06170bdf4aa1856143b2bc17540cf7afe62
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZo:0UzeyQMS4DqodCnoe+iitjWwwM
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 7f4b357a1fb042386e2047718b1e8d6c784d6909b1baf1318f82f6df039b5163
MD5 eccd6db5934cefaf4578422a6b2ebe9e
SHA1 dd0a3c8d5ad84d0ed1f792ed361783a8da78a722
SHA512 4a82765d506d0a9827f74978c1ddb4b4e450112460ec0916671042d507c9cb70b1979c51064020535c930d925c2296d5400b2b406965c635727160abfb281bbd
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZE:0UzeyQMS4DqodCnoe+iitjWwwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-1745-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/224-528-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/224-94-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/336-90-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/336-95-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/496-4556-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/496-4394-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/844-87-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/844-89-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/844-46-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/844-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/892-4234-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/976-4122-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1096-2926-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1236-794-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1236-1641-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1392-3750-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1392-3940-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1456-795-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1456-1660-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1664-2327-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1768-2785-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1800-1658-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1948-4654-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1948-4747-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2204-2234-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2224-4145-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2224-4315-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2232-897-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2396-3432-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2412-1008-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2476-5127-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2544-1650-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2544-1803-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2556-1743-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2748-3963-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2796-3574-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2828-1511-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2828-1629-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2852-4538-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3016-5216-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3100-4776-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3104-4875-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3120-2080-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3120-2078-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3220-1261-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3264-1380-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3300-3650-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3324-4059-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3536-1649-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3540-5363-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3540-5350-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3572-1510-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3608-4998-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3796-4155-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3920-1512-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3920-664-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3932-4767-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3956-5094-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3960-1138-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3964-1262-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3976-2852-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3976-2726-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3984-2411-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4024-3420-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4100-3266-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4100-3269-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4128-3808-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4128-3803-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4136-4347-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4200-1648-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4224-1657-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4236-2000-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4236-2139-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4256-4500-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4256-4497-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4268-3317-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4268-3185-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4336-2709-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4336-2566-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4400-2661-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4400-2657-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4444-4413-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4472-3797-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4484-1821-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4484-1981-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4524-2313-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4524-2221-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4548-3336-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4548-3484-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4624-3015-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4624-2914-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4632-1509-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4720-3169-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4760-1893-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4760-1897-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4768-1137-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4796-0-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/4796-47-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4796-43-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/4796-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4828-4664-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4888-3113-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4944-3989-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4948-1744-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4948-891-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4976-1381-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4996-5283-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4996-5441-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5016-1009-0x0000000000400000-0x00000000005D3000-memory.dmp

Download