pony | bd7baf76fbd95817b2de4be256120181d17c01360b986ca45ee5176114160a07

Analysis

max time kernel
109s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe
Size 2.2MB
Sample240614-e2t6zsvepe
SHA256 bd7baf76fbd95817b2de4be256120181d17c01360b986ca45ee5176114160a07
MD5 a801bc7dc7f3f4d45f087966f63bb49c
SHA1 a0b8b807e8c017bbb666d6ddd14c5a19049c1224
SHA512 1de35a6befe526585c3a45e3cc496d1ad45fb4df952ba75effaeda1e1a3aa7ac83883060b501eeb8e355c16452bc29b8c90b1d62dd4f2f53dcee08b612ff49b0
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ9:0UzeyQMS4DqodCnoe+iitjWww5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe	a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe	a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
3296	explorer.exe
776	explorer.exe
2244	spoolsv.exe
2700	spoolsv.exe
3504	spoolsv.exe
1840	spoolsv.exe
2860	spoolsv.exe
4580	spoolsv.exe
4216	spoolsv.exe
5012	spoolsv.exe
2468	spoolsv.exe
3764	spoolsv.exe
2432	spoolsv.exe
3528	spoolsv.exe
3124	spoolsv.exe
4532	spoolsv.exe
1464	spoolsv.exe
5104	spoolsv.exe
3560	spoolsv.exe
4448	spoolsv.exe
4528	spoolsv.exe
4148	spoolsv.exe
3580	spoolsv.exe
2316	spoolsv.exe
1916	spoolsv.exe
1152	spoolsv.exe
1888	explorer.exe
3540	spoolsv.exe
2228	spoolsv.exe
1972	spoolsv.exe
3180	explorer.exe
3784	spoolsv.exe
4424	spoolsv.exe
1488	spoolsv.exe
4608	spoolsv.exe
4752	explorer.exe
620	spoolsv.exe
4460	spoolsv.exe
1752	spoolsv.exe
2720	spoolsv.exe
1544	explorer.exe
3292	spoolsv.exe
4028	spoolsv.exe
2212	spoolsv.exe
2172	spoolsv.exe
5008	spoolsv.exe
4384	explorer.exe
1108	spoolsv.exe
3264	spoolsv.exe
3380	explorer.exe
1136	spoolsv.exe
2020	spoolsv.exe
4984	spoolsv.exe
4004	spoolsv.exe
1332	explorer.exe
3988	spoolsv.exe
676	spoolsv.exe
4816	spoolsv.exe
3120	explorer.exe
740	spoolsv.exe
516	spoolsv.exe
3316	spoolsv.exe
5060	spoolsv.exe
1680	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 20 IoCs

description	pid	Process	procid_target
PID 228 set thread context of 2944	228	a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe	90
PID 3296 set thread context of 776	3296	explorer.exe	95
PID 2244 set thread context of 1152	2244	spoolsv.exe	119
PID 2700 set thread context of 2228	2700	spoolsv.exe	122
PID 3504 set thread context of 1972	3504	spoolsv.exe	123
PID 1840 set thread context of 4424	1840	spoolsv.exe	126
PID 2860 set thread context of 4608	2860	spoolsv.exe	128
PID 4580 set thread context of 620	4580	spoolsv.exe	130
PID 4216 set thread context of 1752	4216	spoolsv.exe	132
PID 5012 set thread context of 2720	5012	spoolsv.exe	133
PID 2468 set thread context of 3292	2468	spoolsv.exe	135
PID 3764 set thread context of 4028	3764	spoolsv.exe	136
PID 2432 set thread context of 5008	2432	spoolsv.exe	139
PID 3528 set thread context of 3264	3528	spoolsv.exe	142
PID 3124 set thread context of 2020	3124	spoolsv.exe	145
PID 4532 set thread context of 4004	4532	spoolsv.exe	147
PID 1464 set thread context of 3988	1464	spoolsv.exe	149
PID 5104 set thread context of 4816	5104	spoolsv.exe	151
PID 3560 set thread context of 516	3560	spoolsv.exe	154
PID 4448 set thread context of 5060	4448	spoolsv.exe	156

Drops file in Windows directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2944	a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe
2944	a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe

Suspicious use of SetWindowsHookEx 42 IoCs

pid	Process
2944	a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe
2944	a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
776	explorer.exe
1152	spoolsv.exe
1152	spoolsv.exe
2228	spoolsv.exe
2228	spoolsv.exe
1972	spoolsv.exe
1972	spoolsv.exe
4424	spoolsv.exe
4424	spoolsv.exe
4608	spoolsv.exe
4608	spoolsv.exe
620	spoolsv.exe
620	spoolsv.exe
1752	spoolsv.exe
1752	spoolsv.exe
2720	spoolsv.exe
2720	spoolsv.exe
3292	spoolsv.exe
3292	spoolsv.exe
4028	spoolsv.exe
4028	spoolsv.exe
5008	spoolsv.exe
5008	spoolsv.exe
3264	spoolsv.exe
3264	spoolsv.exe
2020	spoolsv.exe
2020	spoolsv.exe
4004	spoolsv.exe
4004	spoolsv.exe
3988	spoolsv.exe
3988	spoolsv.exe
4816	spoolsv.exe
4816	spoolsv.exe
516	spoolsv.exe
516	spoolsv.exe
5060	spoolsv.exe
5060	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 1500	228	a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe	82
PID 228 wrote to memory of 1500	228	a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe	82
PID 228 wrote to memory of 2944	228	a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe	90
PID 228 wrote to memory of 2944	228	a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe	90
PID 228 wrote to memory of 2944	228	a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe	90
PID 228 wrote to memory of 2944	228	a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe	90
PID 228 wrote to memory of 2944	228	a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe	90
PID 2944 wrote to memory of 3296	2944	a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe	91
PID 2944 wrote to memory of 3296	2944	a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe	91
PID 2944 wrote to memory of 3296	2944	a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe	91
PID 3296 wrote to memory of 776	3296	explorer.exe	95
PID 3296 wrote to memory of 776	3296	explorer.exe	95
PID 3296 wrote to memory of 776	3296	explorer.exe	95
PID 3296 wrote to memory of 776	3296	explorer.exe	95
PID 3296 wrote to memory of 776	3296	explorer.exe	95
PID 776 wrote to memory of 2244	776	explorer.exe	96
PID 776 wrote to memory of 2244	776	explorer.exe	96
PID 776 wrote to memory of 2244	776	explorer.exe	96
PID 776 wrote to memory of 2700	776	explorer.exe	97
PID 776 wrote to memory of 2700	776	explorer.exe	97
PID 776 wrote to memory of 2700	776	explorer.exe	97
PID 776 wrote to memory of 3504	776	explorer.exe	98
PID 776 wrote to memory of 3504	776	explorer.exe	98
PID 776 wrote to memory of 3504	776	explorer.exe	98
PID 776 wrote to memory of 1840	776	explorer.exe	99
PID 776 wrote to memory of 1840	776	explorer.exe	99
PID 776 wrote to memory of 1840	776	explorer.exe	99
PID 776 wrote to memory of 2860	776	explorer.exe	100
PID 776 wrote to memory of 2860	776	explorer.exe	100
PID 776 wrote to memory of 2860	776	explorer.exe	100
PID 776 wrote to memory of 4580	776	explorer.exe	101
PID 776 wrote to memory of 4580	776	explorer.exe	101
PID 776 wrote to memory of 4580	776	explorer.exe	101
PID 776 wrote to memory of 4216	776	explorer.exe	102
PID 776 wrote to memory of 4216	776	explorer.exe	102
PID 776 wrote to memory of 4216	776	explorer.exe	102
PID 776 wrote to memory of 5012	776	explorer.exe	103
PID 776 wrote to memory of 5012	776	explorer.exe	103
PID 776 wrote to memory of 5012	776	explorer.exe	103
PID 776 wrote to memory of 2468	776	explorer.exe	104
PID 776 wrote to memory of 2468	776	explorer.exe	104
PID 776 wrote to memory of 2468	776	explorer.exe	104
PID 776 wrote to memory of 3764	776	explorer.exe	105
PID 776 wrote to memory of 3764	776	explorer.exe	105
PID 776 wrote to memory of 3764	776	explorer.exe	105
PID 776 wrote to memory of 2432	776	explorer.exe	106
PID 776 wrote to memory of 2432	776	explorer.exe	106
PID 776 wrote to memory of 2432	776	explorer.exe	106
PID 776 wrote to memory of 3528	776	explorer.exe	107
PID 776 wrote to memory of 3528	776	explorer.exe	107
PID 776 wrote to memory of 3528	776	explorer.exe	107
PID 776 wrote to memory of 3124	776	explorer.exe	108
PID 776 wrote to memory of 3124	776	explorer.exe	108
PID 776 wrote to memory of 3124	776	explorer.exe	108
PID 776 wrote to memory of 4532	776	explorer.exe	109
PID 776 wrote to memory of 4532	776	explorer.exe	109
PID 776 wrote to memory of 4532	776	explorer.exe	109
PID 776 wrote to memory of 1464	776	explorer.exe	110
PID 776 wrote to memory of 1464	776	explorer.exe	110
PID 776 wrote to memory of 1464	776	explorer.exe	110
PID 776 wrote to memory of 5104	776	explorer.exe	111
PID 776 wrote to memory of 5104	776	explorer.exe	111
PID 776 wrote to memory of 5104	776	explorer.exe	111
PID 776 wrote to memory of 3560	776	explorer.exe	112

C:\Users\Admin\AppData\Local\Temp\a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1500
- C:\Users\Admin\AppData\Local\Temp\a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a801bc7dc7f3f4d45f087966f63bb49c_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2944
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3296
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2244
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1152
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1888
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2700
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3504
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1972
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3180
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4608
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4752
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4580
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2720
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1544
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2468
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3764
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2432
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5008
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4384
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3528
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3264
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3380
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3124
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4532
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4004
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1332
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4816
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3120
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5060
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        
        PID:1680
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4528
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3144
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1652
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3580
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4620
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3948
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1916
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2036
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3604
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3784
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1436
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2208
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1488
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4636
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3028
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4460
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3484
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2212
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2172
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3980
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5088
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1136
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4984
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2312
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2180
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:740
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4700
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4920
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3556
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2472
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4520
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:532
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4616
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1240
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2204
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1176
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 5a24824b0d2753d1e0e6e5e54ac544ec52e1c433b26ae7741e944d63f6923c4a
MD5 b96e1eb68b17db75bcd7a32418d5412d
SHA1 36e7e868b9160db4df6d799eab6558920ca702c4
SHA512 798554663af2aee6f4b88af99c9be13dcb480968722e4c8639e8cce2d6ff43f7b672c44ab9745cb02e90420cc0ca617797fcbc025835beca9f0ab3181e917e55
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ/:0UzeyQMS4DqodCnoe+iitjWwwb
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 5b79368af3851ca3e1a5b7b321384840dc39ce461e42898ed6c3e2006840f4d4
MD5 25f90c96d8d1a25113b5407ad6b94fd9
SHA1 c55718f7c5de49a9b1642480ba88874ccb72eea5
SHA512 161a2e697881428592685cc0fd0405b71e07af1afc396035ab57f15f75d9fbb7ca39bb8b54c6c6fbca4fe5686e858d149cab54d52bd858977b42d47fc0b86518
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZm:0UzeyQMS4DqodCnoe+iitjWwwK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/228-21-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/228-23-0x0000000000880000-0x0000000000881000-memory.dmp

Download

memory/228-0-0x0000000000880000-0x0000000000881000-memory.dmp

Download

memory/228-27-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/452-3898-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/452-3894-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/516-2769-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/516-2774-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/532-5137-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/532-4996-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/620-1787-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/748-4874-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/748-4864-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/776-602-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/776-78-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/980-3488-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1152-1567-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1152-1451-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1420-5169-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1420-5164-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1436-3480-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1464-1446-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1752-1888-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1840-842-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1840-1651-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1972-1760-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1972-1606-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2020-2391-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2036-3459-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2036-3308-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2180-4328-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2228-1516-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/2228-1518-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2244-618-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2244-1452-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2304-4611-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2312-4174-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2432-1218-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2444-4181-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2444-4184-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2468-1084-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2552-3666-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2700-724-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2700-1519-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2720-1925-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2720-2047-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2860-843-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2944-24-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2944-26-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2944-62-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2968-5005-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3068-4859-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3076-4348-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3076-4352-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3124-1444-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3144-3041-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3264-2456-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3264-2303-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3292-1933-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3296-79-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3296-73-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3424-2906-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3484-3811-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3484-3951-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3504-1604-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3504-725-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3528-1326-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3556-4750-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3556-4897-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3560-1605-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3764-1217-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3824-3101-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3980-3970-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3980-4148-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3988-2559-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3988-2561-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4004-2669-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4004-2550-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4028-1945-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4028-1941-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4216-965-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4256-3436-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4256-3417-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4352-3980-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4380-4470-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4424-1656-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4448-1655-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4500-5217-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4528-1776-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4532-1445-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4548-4602-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4556-3389-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4580-959-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4608-1777-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4616-5157-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4620-3177-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4636-3595-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4696-4685-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4816-2687-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4816-2822-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4896-4065-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4896-4067-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4904-3822-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4920-4733-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4920-4590-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4932-4341-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5000-4076-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5008-2128-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5008-2282-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5012-1083-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5060-2898-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5060-3021-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5104-1517-0x0000000000400000-0x00000000005D3000-memory.dmp

Download