pony | 36bbe754cb8e02cb24eddb549dfe5534ea4b5949aa755989427e4c9cca65f6c9

Analysis

max time kernel
108s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe
Size 2.2MB
Sample240615-bj5yzsxepk
SHA256 36bbe754cb8e02cb24eddb549dfe5534ea4b5949aa755989427e4c9cca65f6c9
MD5 ac5c33e73d22553df808f89206d3ba53
SHA1 2d3a0f819d1c80c5042c3f2020bd0f1374adf8a8
SHA512 900d5b112056a82b86320e8607e311148dc36ea7d353b7ab5b3f7dbcb0c0bdaf86a7d56cf43a890600bac0942c3f07371c92758ca8c41b0089c6e2060d0d7fc7
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZs:0UzeyQMS4DqodCnoe+iitjWwwo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe	ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe	ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1380	explorer.exe
2052	explorer.exe
4988	spoolsv.exe
668	spoolsv.exe
184	spoolsv.exe
544	spoolsv.exe
3608	spoolsv.exe
4348	spoolsv.exe
4412	spoolsv.exe
2112	spoolsv.exe
2316	spoolsv.exe
3644	spoolsv.exe
1156	spoolsv.exe
3792	spoolsv.exe
1492	spoolsv.exe
2776	spoolsv.exe
2360	spoolsv.exe
3040	spoolsv.exe
4660	spoolsv.exe
5048	spoolsv.exe
3628	spoolsv.exe
1980	spoolsv.exe
3932	spoolsv.exe
3284	spoolsv.exe
5100	spoolsv.exe
5000	spoolsv.exe
3492	spoolsv.exe
4048	explorer.exe
4780	spoolsv.exe
3140	spoolsv.exe
4584	spoolsv.exe
2452	spoolsv.exe
4424	explorer.exe
4220	spoolsv.exe
1532	spoolsv.exe
3336	spoolsv.exe
3152	spoolsv.exe
1984	explorer.exe
4264	spoolsv.exe
1052	spoolsv.exe
1388	spoolsv.exe
1996	spoolsv.exe
868	explorer.exe
312	spoolsv.exe
1736	spoolsv.exe
4572	spoolsv.exe
4556	explorer.exe
1712	spoolsv.exe
2856	spoolsv.exe
4632	spoolsv.exe
3256	explorer.exe
1092	spoolsv.exe
3532	spoolsv.exe
952	spoolsv.exe
4004	spoolsv.exe
2608	explorer.exe
3340	spoolsv.exe
3596	spoolsv.exe
632	spoolsv.exe
2680	explorer.exe
3832	spoolsv.exe
3392	spoolsv.exe
32	spoolsv.exe
4588	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Suspicious use of SetThreadContext 21 IoCs

description	pid	Process	procid_target
PID 344 set thread context of 3060	344	ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe	87
PID 1380 set thread context of 2052	1380	explorer.exe	92
PID 4988 set thread context of 3492	4988	spoolsv.exe	117
PID 668 set thread context of 3140	668	spoolsv.exe	120
PID 184 set thread context of 2452	184	spoolsv.exe	122
PID 544 set thread context of 4220	544	spoolsv.exe	124
PID 3608 set thread context of 1532	3608	spoolsv.exe	125
PID 4348 set thread context of 3152	4348	spoolsv.exe	127
PID 4412 set thread context of 4264	4412	spoolsv.exe	129
PID 2112 set thread context of 1996	2112	spoolsv.exe	132
PID 2316 set thread context of 312	2316	spoolsv.exe	134
PID 3644 set thread context of 4572	3644	spoolsv.exe	136
PID 1156 set thread context of 2856	1156	spoolsv.exe	139
PID 3792 set thread context of 4632	3792	spoolsv.exe	140
PID 1492 set thread context of 3532	1492	spoolsv.exe	143
PID 2776 set thread context of 4004	2776	spoolsv.exe	145
PID 2360 set thread context of 3340	2360	spoolsv.exe	147
PID 3040 set thread context of 632	3040	spoolsv.exe	149
PID 4660 set thread context of 3392	4660	spoolsv.exe	152
PID 5048 set thread context of 32	5048	spoolsv.exe	153
PID 3628 set thread context of 2940	3628	spoolsv.exe	156

Drops file in Windows directory 48 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3060	ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe
3060	ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe

Suspicious use of SetWindowsHookEx 44 IoCs

pid	Process
3060	ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe
3060	ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
2052	explorer.exe
3492	spoolsv.exe
3492	spoolsv.exe
3140	spoolsv.exe
3140	spoolsv.exe
2452	spoolsv.exe
2452	spoolsv.exe
4220	spoolsv.exe
4220	spoolsv.exe
1532	spoolsv.exe
1532	spoolsv.exe
3152	spoolsv.exe
3152	spoolsv.exe
4264	spoolsv.exe
4264	spoolsv.exe
1996	spoolsv.exe
1996	spoolsv.exe
312	spoolsv.exe
312	spoolsv.exe
4572	spoolsv.exe
4572	spoolsv.exe
2856	spoolsv.exe
2856	spoolsv.exe
4632	spoolsv.exe
4632	spoolsv.exe
3532	spoolsv.exe
3532	spoolsv.exe
4004	spoolsv.exe
4004	spoolsv.exe
3340	spoolsv.exe
3340	spoolsv.exe
632	spoolsv.exe
632	spoolsv.exe
3392	spoolsv.exe
3392	spoolsv.exe
32	spoolsv.exe
32	spoolsv.exe
2940	spoolsv.exe
2940	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 344 wrote to memory of 4560	344	ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe	82
PID 344 wrote to memory of 4560	344	ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe	82
PID 344 wrote to memory of 3060	344	ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe	87
PID 344 wrote to memory of 3060	344	ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe	87
PID 344 wrote to memory of 3060	344	ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe	87
PID 344 wrote to memory of 3060	344	ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe	87
PID 344 wrote to memory of 3060	344	ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe	87
PID 3060 wrote to memory of 1380	3060	ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe	88
PID 3060 wrote to memory of 1380	3060	ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe	88
PID 3060 wrote to memory of 1380	3060	ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe	88
PID 1380 wrote to memory of 2052	1380	explorer.exe	92
PID 1380 wrote to memory of 2052	1380	explorer.exe	92
PID 1380 wrote to memory of 2052	1380	explorer.exe	92
PID 1380 wrote to memory of 2052	1380	explorer.exe	92
PID 1380 wrote to memory of 2052	1380	explorer.exe	92
PID 2052 wrote to memory of 4988	2052	explorer.exe	93
PID 2052 wrote to memory of 4988	2052	explorer.exe	93
PID 2052 wrote to memory of 4988	2052	explorer.exe	93
PID 2052 wrote to memory of 668	2052	explorer.exe	94
PID 2052 wrote to memory of 668	2052	explorer.exe	94
PID 2052 wrote to memory of 668	2052	explorer.exe	94
PID 2052 wrote to memory of 184	2052	explorer.exe	95
PID 2052 wrote to memory of 184	2052	explorer.exe	95
PID 2052 wrote to memory of 184	2052	explorer.exe	95
PID 2052 wrote to memory of 544	2052	explorer.exe	96
PID 2052 wrote to memory of 544	2052	explorer.exe	96
PID 2052 wrote to memory of 544	2052	explorer.exe	96
PID 2052 wrote to memory of 3608	2052	explorer.exe	97
PID 2052 wrote to memory of 3608	2052	explorer.exe	97
PID 2052 wrote to memory of 3608	2052	explorer.exe	97
PID 2052 wrote to memory of 4348	2052	explorer.exe	98
PID 2052 wrote to memory of 4348	2052	explorer.exe	98
PID 2052 wrote to memory of 4348	2052	explorer.exe	98
PID 2052 wrote to memory of 4412	2052	explorer.exe	99
PID 2052 wrote to memory of 4412	2052	explorer.exe	99
PID 2052 wrote to memory of 4412	2052	explorer.exe	99
PID 2052 wrote to memory of 2112	2052	explorer.exe	100
PID 2052 wrote to memory of 2112	2052	explorer.exe	100
PID 2052 wrote to memory of 2112	2052	explorer.exe	100
PID 2052 wrote to memory of 2316	2052	explorer.exe	101
PID 2052 wrote to memory of 2316	2052	explorer.exe	101
PID 2052 wrote to memory of 2316	2052	explorer.exe	101
PID 2052 wrote to memory of 3644	2052	explorer.exe	102
PID 2052 wrote to memory of 3644	2052	explorer.exe	102
PID 2052 wrote to memory of 3644	2052	explorer.exe	102
PID 2052 wrote to memory of 1156	2052	explorer.exe	103
PID 2052 wrote to memory of 1156	2052	explorer.exe	103
PID 2052 wrote to memory of 1156	2052	explorer.exe	103
PID 2052 wrote to memory of 3792	2052	explorer.exe	104
PID 2052 wrote to memory of 3792	2052	explorer.exe	104
PID 2052 wrote to memory of 3792	2052	explorer.exe	104
PID 2052 wrote to memory of 1492	2052	explorer.exe	105
PID 2052 wrote to memory of 1492	2052	explorer.exe	105
PID 2052 wrote to memory of 1492	2052	explorer.exe	105
PID 2052 wrote to memory of 2776	2052	explorer.exe	106
PID 2052 wrote to memory of 2776	2052	explorer.exe	106
PID 2052 wrote to memory of 2776	2052	explorer.exe	106
PID 2052 wrote to memory of 2360	2052	explorer.exe	107
PID 2052 wrote to memory of 2360	2052	explorer.exe	107
PID 2052 wrote to memory of 2360	2052	explorer.exe	107
PID 2052 wrote to memory of 3040	2052	explorer.exe	108
PID 2052 wrote to memory of 3040	2052	explorer.exe	108
PID 2052 wrote to memory of 3040	2052	explorer.exe	108
PID 2052 wrote to memory of 4660	2052	explorer.exe	109

C:\Users\Admin\AppData\Local\Temp\ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:344
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4560
- C:\Users\Admin\AppData\Local\Temp\ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ac5c33e73d22553df808f89206d3ba53_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3060
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4988
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3492
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4048
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:184
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2452
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4424
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4348
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3152
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1984
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4412
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1996
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:868
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4572
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4556
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1156
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4632
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3256
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2776
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4004
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2608
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:632
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2680
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4660
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5048
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:32
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        
        PID:4588
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1980
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4380
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1012
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3932
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3284
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4952
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2100
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5100
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1516
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:448
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4780
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2668
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4916
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3336
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3056
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1736
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1712
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4712
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2252
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4492
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2852
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4340
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4384
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1360
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1488
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4848
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:560
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2144
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 65aa6093729604f90e90bdd4f4083800a4500271323c2bb58ee1d5aef07fcf15
MD5 019ae79d0cbcdc70be94d750ba67110b
SHA1 7ebd4ddb101fc6060aaedbbe0ebeee81c7366545
SHA512 7f338fefa075a280cc9dca0431a61cd2482cc00015506c3fe9df138b0069d5eb1f7898f477d9e0cbf35f9c4a97a6ca79c6d9a322fdc688ea87277592ab2a7cea
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZu:0UzeyQMS4DqodCnoe+iitjWwwa
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 803baba470b362cdfeea499484ea5850fdd7f9ff0afe3a981314b7ee0621ca59
MD5 6f9f8707cca407b52721348a40f511c9
SHA1 1b068900d2d0951b60a340d2f065ead7ea17b8ce
SHA512 9c44c790ad1962deca2d2726b6ce2e4ab58cc1dbb151587eaee69fe2e7df16a54c77bcddca56c077b6cdb37cc161ae1fe86e65375b387e7217443d03e4d0a2a1
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZW:0UzeyQMS4DqodCnoe+iitjWwwq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/32-2847-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/184-1676-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/184-692-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/312-2063-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/344-22-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/344-4604-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/344-18-0x0000000002340000-0x0000000002341000-memory.dmp

Download

memory/344-0-0x0000000002340000-0x0000000002341000-memory.dmp

Download

memory/344-16-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/488-4406-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/544-1692-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/544-819-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/632-2694-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/668-1525-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/668-691-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/928-3424-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1156-1225-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1360-5123-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1360-5002-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1380-75-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1380-3433-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1380-81-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1488-5266-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1492-1353-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1516-3335-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1532-1702-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1600-4116-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1932-3850-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1980-1701-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1996-2054-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1996-2127-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2052-80-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2052-567-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2112-1105-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2252-4326-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2252-4184-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2316-1106-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2324-3075-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2360-1462-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2392-4488-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2440-5579-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2452-1683-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2452-1822-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2488-3674-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2548-3956-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2668-3552-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2752-3563-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2776-1461-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2852-4595-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2852-4732-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2856-2280-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2856-2284-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2912-4866-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2924-5100-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2940-2900-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3000-4218-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3040-1463-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3056-4005-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3056-3819-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3060-19-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3060-69-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3060-67-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/3060-21-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3140-1524-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3152-1840-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3152-1951-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3312-4024-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3340-2611-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3392-2770-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3448-4413-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3492-1464-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3492-1559-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3532-2484-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3608-820-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3628-1690-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3644-1224-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3792-1352-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4004-2672-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4004-2603-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4220-1691-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4264-1849-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4264-1853-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4340-4752-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4344-3664-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4348-971-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4380-3015-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4380-3110-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4412-972-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4440-3840-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4460-4856-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4492-4578-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4492-4394-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4572-2192-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4572-2327-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4628-4043-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4632-2525-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4632-2356-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4660-1523-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4712-4032-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4712-4163-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4848-5557-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4848-5384-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4952-3126-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4952-3311-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4988-568-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4988-1465-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5048-1682-0x0000000000400000-0x00000000005D3000-memory.dmp

Download