warzonerat | 1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2024 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe
Size

8.2MB
MD5

1b6f9f0f8009139a81698cda6e140700
SHA1

dd575d166428d7fca33b522914846d09f167b5e9
SHA256

1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8
SHA512

b930864fc236b0c4f997ac2ce908a5d70bfea833d1c639cb8a6212265e7199ba295400acc09fc5fe66706feded3b5ca46fdf80440e441ac7d6207b8379adbb62
SSDEEP

49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecS:V8e8e8f8e8e8X

Score

10^/10

warzonerat aspackv2 discovery evasion infostealer persistence rat

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/files/0x000a000000023cd6-26.dat	warzonerat
behavioral2/files/0x0008000000023ccf-46.dat	warzonerat
behavioral2/files/0x0008000000023cdb-62.dat	warzonerat
behavioral2/files/0x0024000000022aa1-146.dat	warzonerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000a000000023cd6-26.dat	aspack_v212_v242
behavioral2/files/0x0008000000023ccf-46.dat	aspack_v212_v242
behavioral2/files/0x0008000000023cdb-62.dat	aspack_v212_v242
behavioral2/files/0x0024000000022aa1-146.dat	aspack_v212_v242

Executes dropped EXE 47 IoCs

pid	Process
4428	explorer.exe
4548	explorer.exe
3480	spoolsv.exe
1908	spoolsv.exe
3636	spoolsv.exe
1652	spoolsv.exe
4748	spoolsv.exe
1300	spoolsv.exe
2164	spoolsv.exe
3708	spoolsv.exe
3396	spoolsv.exe
2840	spoolsv.exe
4828	spoolsv.exe
3380	spoolsv.exe
1708	spoolsv.exe
2072	spoolsv.exe
1232	spoolsv.exe
4908	spoolsv.exe
3368	spoolsv.exe
648	spoolsv.exe
4648	spoolsv.exe
4224	spoolsv.exe
1912	spoolsv.exe
1616	spoolsv.exe
2816	spoolsv.exe
3932	spoolsv.exe
3924	spoolsv.exe
4088	spoolsv.exe
2736	spoolsv.exe
512	spoolsv.exe
4636	spoolsv.exe
1380	spoolsv.exe
2860	spoolsv.exe
432	spoolsv.exe
4796	spoolsv.exe
4748	spoolsv.exe
4012	spoolsv.exe
1328	spoolsv.exe
3944	spoolsv.exe
1812	spoolsv.exe
3400	spoolsv.exe
4852	spoolsv.exe
228	spoolsv.exe
2552	spoolsv.exe
3544	spoolsv.exe
2768	spoolsv.exe
5004	svchost.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 664 set thread context of 4504	664	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe	103
PID 664 set thread context of 1972	664	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe	104
PID 4428 set thread context of 4548	4428	explorer.exe	107
PID 4428 set thread context of 3792	4428	explorer.exe	108
PID 3480 set thread context of 2768	3480	spoolsv.exe	244
PID 3480 set thread context of 872	3480	spoolsv.exe	245

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 42 IoCs

pid	pid_target	Process	procid_target
5084	1908	WerFault.exe	110
2428	3636	WerFault.exe	115
4364	1652	WerFault.exe	118
1468	4748	WerFault.exe	121
4564	1300	WerFault.exe	124
2320	2164	WerFault.exe	127
1308	3708	WerFault.exe	130
1156	3396	WerFault.exe	133
3068	2840	WerFault.exe	136
2524	4828	WerFault.exe	139
2360	3380	WerFault.exe	142
2604	1708	WerFault.exe	146
3736	2072	WerFault.exe	149
4552	1232	WerFault.exe	153
2304	4908	WerFault.exe	157
5020	3368	WerFault.exe	160
1836	648	WerFault.exe	163
2760	4648	WerFault.exe	168
4012	4224	WerFault.exe	171
1792	1912	WerFault.exe	174
2564	1616	WerFault.exe	177
3748	2816	WerFault.exe	180
4424	3932	WerFault.exe	183
4852	3924	WerFault.exe	186
228	4088	WerFault.exe	189
872	2736	WerFault.exe	192
3376	512	WerFault.exe	197
448	4636	WerFault.exe	201
2636	1380	WerFault.exe	204
5064	2860	WerFault.exe	207
1764	432	WerFault.exe	210
3600	4796	WerFault.exe	213
2796	4748	WerFault.exe	216
3416	4012	WerFault.exe	219
664	1328	WerFault.exe	222
3432	3944	WerFault.exe	225
3016	1812	WerFault.exe	228
920	3400	WerFault.exe	231
3948	4852	WerFault.exe	234
4864	228	WerFault.exe	237
1908	2552	WerFault.exe	240
4352	3544	WerFault.exe	243

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4504	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe
4504	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4548	explorer.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4504	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe
4504	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
4548	explorer.exe
2768	spoolsv.exe
2768	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 4504	664	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe	103
PID 664 wrote to memory of 4504	664	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe	103
PID 664 wrote to memory of 4504	664	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe	103
PID 664 wrote to memory of 4504	664	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe	103
PID 664 wrote to memory of 4504	664	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe	103
PID 664 wrote to memory of 4504	664	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe	103
PID 664 wrote to memory of 4504	664	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe	103
PID 664 wrote to memory of 4504	664	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe	103
PID 664 wrote to memory of 1972	664	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe	104
PID 664 wrote to memory of 1972	664	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe	104
PID 664 wrote to memory of 1972	664	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe	104
PID 664 wrote to memory of 1972	664	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe	104
PID 664 wrote to memory of 1972	664	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe	104
PID 4504 wrote to memory of 4428	4504	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe	105
PID 4504 wrote to memory of 4428	4504	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe	105
PID 4504 wrote to memory of 4428	4504	1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe	105
PID 4428 wrote to memory of 4548	4428	explorer.exe	107
PID 4428 wrote to memory of 4548	4428	explorer.exe	107
PID 4428 wrote to memory of 4548	4428	explorer.exe	107
PID 4428 wrote to memory of 4548	4428	explorer.exe	107
PID 4428 wrote to memory of 4548	4428	explorer.exe	107
PID 4428 wrote to memory of 4548	4428	explorer.exe	107
PID 4428 wrote to memory of 4548	4428	explorer.exe	107
PID 4428 wrote to memory of 4548	4428	explorer.exe	107
PID 4428 wrote to memory of 3792	4428	explorer.exe	108
PID 4428 wrote to memory of 3792	4428	explorer.exe	108
PID 4428 wrote to memory of 3792	4428	explorer.exe	108
PID 4428 wrote to memory of 3792	4428	explorer.exe	108
PID 4428 wrote to memory of 3792	4428	explorer.exe	108
PID 4548 wrote to memory of 3480	4548	explorer.exe	109
PID 4548 wrote to memory of 3480	4548	explorer.exe	109
PID 4548 wrote to memory of 3480	4548	explorer.exe	109
PID 4548 wrote to memory of 1908	4548	explorer.exe	110
PID 4548 wrote to memory of 1908	4548	explorer.exe	110
PID 4548 wrote to memory of 1908	4548	explorer.exe	110
PID 4548 wrote to memory of 3636	4548	explorer.exe	115
PID 4548 wrote to memory of 3636	4548	explorer.exe	115
PID 4548 wrote to memory of 3636	4548	explorer.exe	115
PID 4548 wrote to memory of 1652	4548	explorer.exe	118
PID 4548 wrote to memory of 1652	4548	explorer.exe	118
PID 4548 wrote to memory of 1652	4548	explorer.exe	118
PID 4548 wrote to memory of 4748	4548	explorer.exe	121
PID 4548 wrote to memory of 4748	4548	explorer.exe	121
PID 4548 wrote to memory of 4748	4548	explorer.exe	121
PID 4548 wrote to memory of 1300	4548	explorer.exe	124
PID 4548 wrote to memory of 1300	4548	explorer.exe	124
PID 4548 wrote to memory of 1300	4548	explorer.exe	124
PID 4548 wrote to memory of 2164	4548	explorer.exe	127
PID 4548 wrote to memory of 2164	4548	explorer.exe	127
PID 4548 wrote to memory of 2164	4548	explorer.exe	127
PID 4548 wrote to memory of 3708	4548	explorer.exe	130
PID 4548 wrote to memory of 3708	4548	explorer.exe	130
PID 4548 wrote to memory of 3708	4548	explorer.exe	130
PID 4548 wrote to memory of 3396	4548	explorer.exe	133
PID 4548 wrote to memory of 3396	4548	explorer.exe	133
PID 4548 wrote to memory of 3396	4548	explorer.exe	133
PID 4548 wrote to memory of 2840	4548	explorer.exe	136
PID 4548 wrote to memory of 2840	4548	explorer.exe	136
PID 4548 wrote to memory of 2840	4548	explorer.exe	136
PID 4548 wrote to memory of 4828	4548	explorer.exe	139
PID 4548 wrote to memory of 4828	4548	explorer.exe	139
PID 4548 wrote to memory of 4828	4548	explorer.exe	139
PID 4548 wrote to memory of 3380	4548	explorer.exe	142
PID 4548 wrote to memory of 3380	4548	explorer.exe	142

C:\Users\Admin\AppData\Local\Temp\1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe
"C:\Users\Admin\AppData\Local\Temp\1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:664
- C:\Users\Admin\AppData\Local\Temp\1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe
  "C:\Users\Admin\AppData\Local\Temp\1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8N.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4504
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4428
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3480
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2768
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5004
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1908
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 200
        6⤵
        Program crash
        
        PID:5084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3636
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 192
        6⤵
        Program crash
        
        PID:2428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1652
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 192
        6⤵
        Program crash
        
        PID:4364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4748
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 192
        6⤵
        Program crash
        
        PID:1468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1300
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 192
        6⤵
        Program crash
        
        PID:4564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2164
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 196
        6⤵
        Program crash
        
        PID:2320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3708
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 192
        6⤵
        Program crash
        
        PID:1308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3396
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 192
        6⤵
        Program crash
        
        PID:1156
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2840
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 192
        6⤵
        Program crash
        
        PID:3068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4828
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 200
        6⤵
        Program crash
        
        PID:2524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3380
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 192
        6⤵
        Program crash
        
        PID:2360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1708
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 196
        6⤵
        Program crash
        
        PID:2604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2072
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 192
        6⤵
        Program crash
        
        PID:3736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1232
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 192
        6⤵
        Program crash
        
        PID:4552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4908
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 192
        6⤵
        Program crash
        
        PID:2304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3368
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 200
        6⤵
        Program crash
        
        PID:5020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:648
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 192
        6⤵
        Program crash
        
        PID:1836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4648
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 192
        6⤵
        Program crash
        
        PID:2760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4224
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 192
        6⤵
        Program crash
        
        PID:4012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1912
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 192
        6⤵
        Program crash
        
        PID:1792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1616
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 192
        6⤵
        Program crash
        
        PID:2564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2816
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 192
        6⤵
        Program crash
        
        PID:3748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3932
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 192
        6⤵
        Program crash
        
        PID:4424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3924
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 192
        6⤵
        Program crash
        
        PID:4852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4088
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 192
        6⤵
        Program crash
        
        PID:228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2736
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 192
        6⤵
        Program crash
        
        PID:872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:512
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 200
        6⤵
        Program crash
        
        PID:3376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4636
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 192
        6⤵
        Program crash
        
        PID:448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1380
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 192
        6⤵
        Program crash
        
        PID:2636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2860
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 192
        6⤵
        Program crash
        
        PID:5064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:432
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 192
        6⤵
        Program crash
        
        PID:1764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4796
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 192
        6⤵
        Program crash
        
        PID:3600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4748
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 192
        6⤵
        Program crash
        
        PID:2796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4012
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 192
        6⤵
        Program crash
        
        PID:3416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1328
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 192
        6⤵
        Program crash
        
        PID:664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3944
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 192
        6⤵
        Program crash
        
        PID:3432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 192
        6⤵
        Program crash
        
        PID:3016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3400
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 200
        6⤵
        Program crash
        
        PID:920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4852
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 192
        6⤵
        Program crash
        
        PID:3948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:228
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 192
        6⤵
        Program crash
        
        PID:4864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2552
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 192
        6⤵
        Program crash
        
        PID:1908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3544
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 192
        6⤵
        Program crash
        
        PID:4352
  - - C:\Windows\SysWOW64\diskperf.exe
      "C:\Windows\SysWOW64\diskperf.exe"
      4⤵
      PID:3792
- C:\Windows\SysWOW64\diskperf.exe
  "C:\Windows\SysWOW64\diskperf.exe"
  2⤵
  PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1908 -ip 1908
1⤵
PID:888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3636 -ip 3636
1⤵
PID:696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1652 -ip 1652
1⤵
PID:1764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4748 -ip 4748
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1300 -ip 1300
1⤵
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2164 -ip 2164
1⤵
PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3708 -ip 3708
1⤵
PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3396 -ip 3396
1⤵
PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2840 -ip 2840
1⤵
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4828 -ip 4828
1⤵
PID:1176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3380 -ip 3380
1⤵
PID:4088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1708 -ip 1708
1⤵
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2072 -ip 2072
1⤵
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1232 -ip 1232
1⤵
PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4908 -ip 4908
1⤵
PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3368 -ip 3368
1⤵
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 648 -ip 648
1⤵
PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4648 -ip 4648
1⤵
PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4224 -ip 4224
1⤵
PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1912 -ip 1912
1⤵
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1616 -ip 1616
1⤵
PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2816 -ip 2816
1⤵
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3932 -ip 3932
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3924 -ip 3924
1⤵
PID:2332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4088 -ip 4088
1⤵
PID:552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2736 -ip 2736
1⤵
PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 512 -ip 512
1⤵
PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4636 -ip 4636
1⤵
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1380 -ip 1380
1⤵
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2860 -ip 2860
1⤵
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 432 -ip 432
1⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4796 -ip 4796
1⤵
PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4748 -ip 4748
1⤵
PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4012 -ip 4012
1⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1328 -ip 1328
1⤵
PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3944 -ip 3944
1⤵
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1812 -ip 1812
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3400 -ip 3400
1⤵
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4852 -ip 4852
1⤵
PID:776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 228 -ip 228
1⤵
PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2552 -ip 2552
1⤵
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3544 -ip 3544
1⤵
PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

Filesize
8.2MB

MD5
1b6f9f0f8009139a81698cda6e140700

SHA1
dd575d166428d7fca33b522914846d09f167b5e9

SHA256
1e42befc54138f756db19bc589873d8ef5b1bc791546111aae147b355a7920c8

SHA512
b930864fc236b0c4f997ac2ce908a5d70bfea833d1c639cb8a6212265e7199ba295400acc09fc5fe66706feded3b5ca46fdf80440e441ac7d6207b8379adbb62

Download Submit
C:\Windows\System\explorer.exe

Filesize
8.2MB

MD5
dfe65164e480ef6cf0e09ac796b4d6ab

SHA1
67ce6a02cf033c41c41bebbdcc54dffa07697118

SHA256
38346f5251d5f3111f48ae3283cf9e2d2025bfbd41f8e3916e0ba18cadcd1582

SHA512
a12aba66479ae966ed0515c1c83c51868299eb18f42ee0952b5e4c9f92a2cb21d6652ee7888a74001a6eca075fb2d43a659e0ba0aa00c42ff77a160d790a6404

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
8.2MB

MD5
f0e9e0a3c073fc5da2db103a0e746cf1

SHA1
42b42193b143c0f1609f0b47eaca9aa6b1d71f37

SHA256
99737ebc67d32fa1a694233495a608ac4ca2c57252ef05f8577ff11208f22743

SHA512
986c0a640fb0e86f801d413be7eee68d43cbd4f6ca3402b57f6a63e8c04c47e5dc2079bdc312cbd1cc7dbb6b20c9f0226b3921aa892e6a9034e11717d3eae687

Download Submit
C:\Windows\System\svchost.exe

Filesize
8.2MB

MD5
88b951539509067c6e949eb21d264a2e

SHA1
7d574795b3b23f31b5215bff76de0cc1252ae50a

SHA256
898f26756425be6f3c7f570e6f953ccbced537fde5c4486c387a0ff8ab0e4ec8

SHA512
11dd3b4d9375ba5d576b25dcadfba009dd01945889e34c3f831eee170128b72816a3e1263e14e8afbed8cbc6b4af622e196dc8b0f3356e06a5bf064799dbc28c

Download Submit
memory/648-93-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/664-23-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/664-1-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/664-2-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/664-4-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/664-3-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/664-0-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/664-6-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/1908-70-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1912-100-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1972-19-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1972-18-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1972-15-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2736-107-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2768-152-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2768-136-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2768-150-0x00000000004E0000-0x00000000005A9000-memory.dmp

Filesize
804KB

Download
memory/3400-123-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3480-65-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3480-79-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3480-142-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3480-64-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3480-66-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3636-72-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3708-80-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3792-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4428-58-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4428-30-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4428-31-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4428-35-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4428-32-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4504-12-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4504-34-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4504-10-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4548-75-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4548-48-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4548-153-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4648-96-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/5004-148-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/5004-149-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/5004-154-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download