pony | aed154a52a54a95e4a70546fb61a37aa3596a7df0a3f6433c110a148e28f723b

Analysis

max time kernel
77s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 04:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe
Size

2.2MB
MD5

a3c4a4bfec329bbd6d65307a213e6dc4
SHA1

a3d52fa42e4abbd47b4d551083a3d6634c600431
SHA256

aed154a52a54a95e4a70546fb61a37aa3596a7df0a3f6433c110a148e28f723b
SHA512

7b1c321bbe9896c69068b13b18fdf9fc1d95cca0db9d59642fac2cfe1abcd0da89f6cdc02a96ac406cb39901355cde1ed6d2a52ef6b8acee95e87302f0147144
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ5:0UzeyQMS4DqodCnoe+iitjWwwV

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe

Executes dropped EXE 53 IoCs

pid	Process
2948	explorer.exe
2060	explorer.exe
1092	spoolsv.exe
2040	spoolsv.exe
2384	spoolsv.exe
816	spoolsv.exe
964	spoolsv.exe
2600	spoolsv.exe
2580	spoolsv.exe
472	spoolsv.exe
2732	spoolsv.exe
1996	spoolsv.exe
1444	spoolsv.exe
1108	spoolsv.exe
2216	spoolsv.exe
2072	spoolsv.exe
2424	spoolsv.exe
1008	spoolsv.exe
760	spoolsv.exe
2656	spoolsv.exe
2204	spoolsv.exe
792	spoolsv.exe
2276	spoolsv.exe
1732	spoolsv.exe
1656	spoolsv.exe
2348	spoolsv.exe
1560	spoolsv.exe
1076	spoolsv.exe
112	spoolsv.exe
1000	spoolsv.exe
676	spoolsv.exe
2528	spoolsv.exe
2988	spoolsv.exe
1640	spoolsv.exe
860	spoolsv.exe
2896	spoolsv.exe
2644	spoolsv.exe
608	spoolsv.exe
2928	spoolsv.exe
2296	spoolsv.exe
2968	spoolsv.exe
2540	spoolsv.exe
332	spoolsv.exe
2264	spoolsv.exe
432	spoolsv.exe
1744	spoolsv.exe
2668	spoolsv.exe
2552	spoolsv.exe
384	spoolsv.exe
2628	spoolsv.exe
2444	spoolsv.exe
2408	spoolsv.exe
1452	spoolsv.exe

Loads dropped DLL 64 IoCs

pid	Process
2520	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe
2520	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2860 set thread context of 2520	2860	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe	29
PID 2948 set thread context of 2060	2948	explorer.exe	33

Drops file in Windows directory 55 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
2520	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2060	explorer.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2520	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe
2520	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2504	2860	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe	28
PID 2860 wrote to memory of 2504	2860	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe	28
PID 2860 wrote to memory of 2504	2860	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe	28
PID 2860 wrote to memory of 2504	2860	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe	28
PID 2860 wrote to memory of 2520	2860	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe	29
PID 2860 wrote to memory of 2520	2860	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe	29
PID 2860 wrote to memory of 2520	2860	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe	29
PID 2860 wrote to memory of 2520	2860	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe	29
PID 2860 wrote to memory of 2520	2860	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe	29
PID 2860 wrote to memory of 2520	2860	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe	29
PID 2520 wrote to memory of 2948	2520	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2948	2520	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2948	2520	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe	30
PID 2520 wrote to memory of 2948	2520	a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe	30
PID 2948 wrote to memory of 2060	2948	explorer.exe	33
PID 2948 wrote to memory of 2060	2948	explorer.exe	33
PID 2948 wrote to memory of 2060	2948	explorer.exe	33
PID 2948 wrote to memory of 2060	2948	explorer.exe	33
PID 2948 wrote to memory of 2060	2948	explorer.exe	33
PID 2948 wrote to memory of 2060	2948	explorer.exe	33
PID 2060 wrote to memory of 1092	2060	explorer.exe	34
PID 2060 wrote to memory of 1092	2060	explorer.exe	34
PID 2060 wrote to memory of 1092	2060	explorer.exe	34
PID 2060 wrote to memory of 1092	2060	explorer.exe	34
PID 2060 wrote to memory of 2040	2060	explorer.exe	35
PID 2060 wrote to memory of 2040	2060	explorer.exe	35
PID 2060 wrote to memory of 2040	2060	explorer.exe	35
PID 2060 wrote to memory of 2040	2060	explorer.exe	35
PID 2060 wrote to memory of 2384	2060	explorer.exe	36
PID 2060 wrote to memory of 2384	2060	explorer.exe	36
PID 2060 wrote to memory of 2384	2060	explorer.exe	36
PID 2060 wrote to memory of 2384	2060	explorer.exe	36
PID 2060 wrote to memory of 816	2060	explorer.exe	37
PID 2060 wrote to memory of 816	2060	explorer.exe	37
PID 2060 wrote to memory of 816	2060	explorer.exe	37
PID 2060 wrote to memory of 816	2060	explorer.exe	37
PID 2060 wrote to memory of 964	2060	explorer.exe	38
PID 2060 wrote to memory of 964	2060	explorer.exe	38
PID 2060 wrote to memory of 964	2060	explorer.exe	38
PID 2060 wrote to memory of 964	2060	explorer.exe	38
PID 2060 wrote to memory of 2600	2060	explorer.exe	39
PID 2060 wrote to memory of 2600	2060	explorer.exe	39
PID 2060 wrote to memory of 2600	2060	explorer.exe	39
PID 2060 wrote to memory of 2600	2060	explorer.exe	39
PID 2060 wrote to memory of 2580	2060	explorer.exe	40
PID 2060 wrote to memory of 2580	2060	explorer.exe	40
PID 2060 wrote to memory of 2580	2060	explorer.exe	40
PID 2060 wrote to memory of 2580	2060	explorer.exe	40
PID 2060 wrote to memory of 472	2060	explorer.exe	41
PID 2060 wrote to memory of 472	2060	explorer.exe	41
PID 2060 wrote to memory of 472	2060	explorer.exe	41
PID 2060 wrote to memory of 472	2060	explorer.exe	41
PID 2060 wrote to memory of 2732	2060	explorer.exe	42
PID 2060 wrote to memory of 2732	2060	explorer.exe	42
PID 2060 wrote to memory of 2732	2060	explorer.exe	42
PID 2060 wrote to memory of 2732	2060	explorer.exe	42
PID 2060 wrote to memory of 1996	2060	explorer.exe	43
PID 2060 wrote to memory of 1996	2060	explorer.exe	43
PID 2060 wrote to memory of 1996	2060	explorer.exe	43
PID 2060 wrote to memory of 1996	2060	explorer.exe	43
PID 2060 wrote to memory of 1444	2060	explorer.exe	44
PID 2060 wrote to memory of 1444	2060	explorer.exe	44
PID 2060 wrote to memory of 1444	2060	explorer.exe	44
PID 2060 wrote to memory of 1444	2060	explorer.exe	44

C:\Users\Admin\AppData\Local\Temp\a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2504
- C:\Users\Admin\AppData\Local\Temp\a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a3c4a4bfec329bbd6d65307a213e6dc4_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2520
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1336
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2384
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:816
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2600
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3704
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2580
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:472
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3836
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1996
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2072
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:760
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1692
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2656
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2204
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2276
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1656
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2348
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2528
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2988
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2896
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3784
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2296
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2968
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2264
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:432
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1744
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:384
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2408
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1452
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1240
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2900
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2496
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1968
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1620
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:524
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1696
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:880
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2604
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1236
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System32\spool\drivers\x64\3\mxdwdui.BUD

Filesize
56KB

MD5
bd72dcf1083b6e22ccbfa0e8e27fb1e0

SHA1
3fd23d4f14da768da7b8364d74c54932d704e74e

SHA256
90f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1

SHA512
72360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562

Download Submit
\Windows\system\explorer.exe

Filesize
2.2MB

MD5
d4a3b7da4a56926f6569d9e134b247b9

SHA1
96fc759cb1a3028fa6d5fd13980070c5593849a1

SHA256
2f28eeaf76aa681764c9835ace86b2ec10460f1b02caaf827be1e2b8d1e72483

SHA512
6bd4d61193f6f5552fa1cd560f6d79fa36d55ef7559f8f8ebca55659ff2e6c85ee02ff95f221ab15f15956f302f566e11fda684831dbc515317b1e554aaef469

Download Submit
\Windows\system\spoolsv.exe

Filesize
2.2MB

MD5
bd74aef55aedb6e195b895327d130b72

SHA1
6c0ac7205516d0c43ca52c10d379d409de4f3ad5

SHA256
1cd6ddef5c14f63d3123c6e089405cfab0d4d3c5da08e18dd28746687a480118

SHA512
15ac571b861b4352a971c49e607a3e7b5809233f82e9a4c75c95f606dc632066f815c2f63b87aecd241d364eb5b0a29edf7dcd2ade8a67fd972b0e4790eae658

Download Submit
memory/112-2059-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/472-1728-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/676-2061-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/760-1897-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/792-1900-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/816-1579-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/964-1580-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1000-2060-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1008-1896-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1076-2058-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1092-1334-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1096-2443-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1108-1737-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1336-2495-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1336-2406-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1444-1736-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1460-2745-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1476-3399-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1560-2057-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1656-1903-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1692-2891-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1732-1902-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1904-3134-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1952-2611-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1996-1735-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2008-2565-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2016-2790-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2040-1335-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2060-1333-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2072-1739-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2204-1899-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2208-2859-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2216-1738-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2276-1901-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2332-3033-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2348-1904-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2380-3044-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2384-1336-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2424-1895-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2460-3189-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2496-3345-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2520-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2520-20-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2520-51-0x0000000000440000-0x000000000051F000-memory.dmp

Filesize
892KB

Download
memory/2520-27-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2520-56-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2520-29-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2528-2062-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2580-1582-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2596-2810-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2600-1581-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2656-1898-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2688-3276-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2732-1729-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2804-2398-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2860-19-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2860-28-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2860-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2860-17-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2948-42-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2948-72-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2948-62-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3092-3356-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3256-2478-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3324-2778-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3388-3443-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3404-2978-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3488-2624-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3704-2641-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3704-2551-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3720-2516-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3820-3238-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3836-2662-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3836-2828-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3972-2871-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download