pony | 8d2f6ea6efd1dd28443ee50bcfd049beade874c35b25c6afcd75f3b532a8ab2a

Analysis

max time kernel
136s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2024, 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe
Size

2.2MB
MD5

ca2351a18c4738205f2e2b42cd9c9eb3
SHA1

8820042b845738d92ff89f00eabf859158905311
SHA256

8d2f6ea6efd1dd28443ee50bcfd049beade874c35b25c6afcd75f3b532a8ab2a
SHA512

d8e79a10264008bf409824794933e1c5a8fd04430da7e9ff5a69cd7fd0a8b6500ce24ee047754eb46a4625897bd15eade43cb8ab602db041c98a17c5efb80336
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZA:0UzeyQMS4DqodCnoe+iitjWwws

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1996	explorer.exe
220	explorer.exe
4356	spoolsv.exe
1940	spoolsv.exe
2492	spoolsv.exe
4952	spoolsv.exe
3208	spoolsv.exe
2332	spoolsv.exe
4416	spoolsv.exe
3572	spoolsv.exe
2904	spoolsv.exe
3992	spoolsv.exe
920	spoolsv.exe
2036	spoolsv.exe
4344	spoolsv.exe
5100	spoolsv.exe
216	spoolsv.exe
3752	spoolsv.exe
3680	spoolsv.exe
4388	spoolsv.exe
4300	spoolsv.exe
1252	spoolsv.exe
3932	spoolsv.exe
4064	spoolsv.exe
5048	spoolsv.exe
1028	spoolsv.exe
2992	spoolsv.exe
2436	spoolsv.exe
4448	spoolsv.exe
3024	spoolsv.exe
1732	spoolsv.exe
2280	spoolsv.exe
5084	spoolsv.exe
3668	spoolsv.exe
1936	explorer.exe
2924	spoolsv.exe
2592	spoolsv.exe
2572	spoolsv.exe
4724	spoolsv.exe
1472	spoolsv.exe
4528	spoolsv.exe
632	spoolsv.exe
4948	explorer.exe
4684	spoolsv.exe
4412	spoolsv.exe
3848	spoolsv.exe
1924	spoolsv.exe
3112	spoolsv.exe
4452	spoolsv.exe
3608	explorer.exe
3224	spoolsv.exe
3620	spoolsv.exe
3376	spoolsv.exe
1472	spoolsv.exe
3920	explorer.exe
2920	spoolsv.exe
2960	spoolsv.exe
4124	spoolsv.exe
3712	spoolsv.exe
4364	spoolsv.exe
1476	explorer.exe
1728	spoolsv.exe
2356	spoolsv.exe
1928	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Suspicious use of SetThreadContext 44 IoCs

description	pid	Process	procid_target
PID 2472 set thread context of 4844	2472	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe	96
PID 1996 set thread context of 220	1996	explorer.exe	101
PID 4356 set thread context of 3668	4356	spoolsv.exe	134
PID 1940 set thread context of 2924	1940	spoolsv.exe	136
PID 2492 set thread context of 2592	2492	spoolsv.exe	137
PID 4952 set thread context of 2572	4952	spoolsv.exe	138
PID 3208 set thread context of 4724	3208	spoolsv.exe	139
PID 2332 set thread context of 1472	2332	spoolsv.exe	140
PID 4416 set thread context of 632	4416	spoolsv.exe	142
PID 3572 set thread context of 4684	3572	spoolsv.exe	144
PID 2904 set thread context of 4412	2904	spoolsv.exe	145
PID 3992 set thread context of 3848	3992	spoolsv.exe	146
PID 920 set thread context of 1924	920	spoolsv.exe	147
PID 2036 set thread context of 4452	2036	spoolsv.exe	149
PID 4344 set thread context of 3224	4344	spoolsv.exe	151
PID 5100 set thread context of 3620	5100	spoolsv.exe	152
PID 216 set thread context of 1472	216	spoolsv.exe	154
PID 3752 set thread context of 2920	3752	spoolsv.exe	156
PID 3680 set thread context of 2960	3680	spoolsv.exe	157
PID 4388 set thread context of 4124	4388	spoolsv.exe	158
PID 4300 set thread context of 3712	4300	spoolsv.exe	160
PID 1252 set thread context of 4364	1252	spoolsv.exe	161
PID 3932 set thread context of 2356	3932	spoolsv.exe	164
PID 4064 set thread context of 1928	4064	spoolsv.exe	165
PID 5048 set thread context of 552	5048	spoolsv.exe	166
PID 1028 set thread context of 4824	1028	spoolsv.exe	169
PID 2992 set thread context of 5080	2992	spoolsv.exe	170
PID 2436 set thread context of 1792	2436	spoolsv.exe	171
PID 4448 set thread context of 2956	4448	spoolsv.exe	172
PID 3024 set thread context of 4332	3024	spoolsv.exe	174
PID 1732 set thread context of 2528	1732	spoolsv.exe	176
PID 2280 set thread context of 1544	2280	spoolsv.exe	177
PID 5084 set thread context of 2916	5084	spoolsv.exe	189
PID 1936 set thread context of 3452	1936	explorer.exe	188
PID 4528 set thread context of 4632	4528	spoolsv.exe	198
PID 4948 set thread context of 2816	4948	explorer.exe	200
PID 3112 set thread context of 3616	3112	spoolsv.exe	203
PID 3608 set thread context of 2528	3608	explorer.exe	205
PID 3920 set thread context of 1960	3920	explorer.exe	215
PID 3376 set thread context of 2040	3376	spoolsv.exe	210
PID 1476 set thread context of 836	1476	explorer.exe	213
PID 1728 set thread context of 1960	1728	spoolsv.exe	215
PID 1532 set thread context of 5312	1532	explorer.exe	219
PID 4712 set thread context of 5380	4712	spoolsv.exe	220

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4844	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe
4844	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
220	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4844	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe
4844	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
3668	spoolsv.exe
3668	spoolsv.exe
2924	spoolsv.exe
2924	spoolsv.exe
2592	spoolsv.exe
2592	spoolsv.exe
2572	spoolsv.exe
2572	spoolsv.exe
4724	spoolsv.exe
4724	spoolsv.exe
1472	spoolsv.exe
1472	spoolsv.exe
632	spoolsv.exe
632	spoolsv.exe
4684	spoolsv.exe
4684	spoolsv.exe
4412	spoolsv.exe
4412	spoolsv.exe
3848	spoolsv.exe
3848	spoolsv.exe
1924	spoolsv.exe
1924	spoolsv.exe
4452	spoolsv.exe
4452	spoolsv.exe
3224	spoolsv.exe
3224	spoolsv.exe
3620	spoolsv.exe
3620	spoolsv.exe
1472	spoolsv.exe
1472	spoolsv.exe
2920	spoolsv.exe
2920	spoolsv.exe
2960	spoolsv.exe
2960	spoolsv.exe
4124	spoolsv.exe
4124	spoolsv.exe
3712	spoolsv.exe
3712	spoolsv.exe
4364	spoolsv.exe
4364	spoolsv.exe
2356	spoolsv.exe
2356	spoolsv.exe
1928	spoolsv.exe
1928	spoolsv.exe
552	spoolsv.exe
552	spoolsv.exe
4824	spoolsv.exe
4824	spoolsv.exe
5080	spoolsv.exe
5080	spoolsv.exe
1792	spoolsv.exe
1792	spoolsv.exe
2956	spoolsv.exe
2956	spoolsv.exe
4332	spoolsv.exe
4332	spoolsv.exe
2528	spoolsv.exe
2528	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 1660	2472	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe	84
PID 2472 wrote to memory of 1660	2472	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe	84
PID 2472 wrote to memory of 4844	2472	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe	96
PID 2472 wrote to memory of 4844	2472	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe	96
PID 2472 wrote to memory of 4844	2472	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe	96
PID 2472 wrote to memory of 4844	2472	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe	96
PID 2472 wrote to memory of 4844	2472	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe	96
PID 4844 wrote to memory of 1996	4844	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe	97
PID 4844 wrote to memory of 1996	4844	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe	97
PID 4844 wrote to memory of 1996	4844	ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe	97
PID 1996 wrote to memory of 220	1996	explorer.exe	101
PID 1996 wrote to memory of 220	1996	explorer.exe	101
PID 1996 wrote to memory of 220	1996	explorer.exe	101
PID 1996 wrote to memory of 220	1996	explorer.exe	101
PID 1996 wrote to memory of 220	1996	explorer.exe	101
PID 220 wrote to memory of 4356	220	explorer.exe	102
PID 220 wrote to memory of 4356	220	explorer.exe	102
PID 220 wrote to memory of 4356	220	explorer.exe	102
PID 220 wrote to memory of 1940	220	explorer.exe	103
PID 220 wrote to memory of 1940	220	explorer.exe	103
PID 220 wrote to memory of 1940	220	explorer.exe	103
PID 220 wrote to memory of 2492	220	explorer.exe	104
PID 220 wrote to memory of 2492	220	explorer.exe	104
PID 220 wrote to memory of 2492	220	explorer.exe	104
PID 220 wrote to memory of 4952	220	explorer.exe	105
PID 220 wrote to memory of 4952	220	explorer.exe	105
PID 220 wrote to memory of 4952	220	explorer.exe	105
PID 220 wrote to memory of 3208	220	explorer.exe	106
PID 220 wrote to memory of 3208	220	explorer.exe	106
PID 220 wrote to memory of 3208	220	explorer.exe	106
PID 220 wrote to memory of 2332	220	explorer.exe	107
PID 220 wrote to memory of 2332	220	explorer.exe	107
PID 220 wrote to memory of 2332	220	explorer.exe	107
PID 220 wrote to memory of 4416	220	explorer.exe	108
PID 220 wrote to memory of 4416	220	explorer.exe	108
PID 220 wrote to memory of 4416	220	explorer.exe	108
PID 220 wrote to memory of 3572	220	explorer.exe	109
PID 220 wrote to memory of 3572	220	explorer.exe	109
PID 220 wrote to memory of 3572	220	explorer.exe	109
PID 220 wrote to memory of 2904	220	explorer.exe	110
PID 220 wrote to memory of 2904	220	explorer.exe	110
PID 220 wrote to memory of 2904	220	explorer.exe	110
PID 220 wrote to memory of 3992	220	explorer.exe	111
PID 220 wrote to memory of 3992	220	explorer.exe	111
PID 220 wrote to memory of 3992	220	explorer.exe	111
PID 220 wrote to memory of 920	220	explorer.exe	112
PID 220 wrote to memory of 920	220	explorer.exe	112
PID 220 wrote to memory of 920	220	explorer.exe	112
PID 220 wrote to memory of 2036	220	explorer.exe	114
PID 220 wrote to memory of 2036	220	explorer.exe	114
PID 220 wrote to memory of 2036	220	explorer.exe	114
PID 220 wrote to memory of 4344	220	explorer.exe	115
PID 220 wrote to memory of 4344	220	explorer.exe	115
PID 220 wrote to memory of 4344	220	explorer.exe	115
PID 220 wrote to memory of 5100	220	explorer.exe	116
PID 220 wrote to memory of 5100	220	explorer.exe	116
PID 220 wrote to memory of 5100	220	explorer.exe	116
PID 220 wrote to memory of 216	220	explorer.exe	117
PID 220 wrote to memory of 216	220	explorer.exe	117
PID 220 wrote to memory of 216	220	explorer.exe	117
PID 220 wrote to memory of 3752	220	explorer.exe	118
PID 220 wrote to memory of 3752	220	explorer.exe	118
PID 220 wrote to memory of 3752	220	explorer.exe	118
PID 220 wrote to memory of 3680	220	explorer.exe	119

C:\Users\Admin\AppData\Local\Temp\ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1660
- C:\Users\Admin\AppData\Local\Temp\ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ca2351a18c4738205f2e2b42cd9c9eb3_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4844
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4356
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3668
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1936
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1940
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4416
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:632
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4948
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4452
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3608
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4344
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5100
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1472
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3920
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3752
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3680
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4300
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1252
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4364
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1476
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3932
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5048
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:552
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1532
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3024
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4332
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:940
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:6084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2280
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5084
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2916
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3388
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4528
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4632
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4792
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3616
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2040
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1728
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1960
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4712
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5380
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1976
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6008
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:6048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3480
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4288
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2756
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3356
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6140
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1996
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4128
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4888
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
e22a18c731fd0ab24520996a887220c1

SHA1
1fa4d729f1f1e1f90465af22471b765dcab5943f

SHA256
b7a484a8cee0c32f4a4f50add0bff6a808428ad590991a92576af3e098a33517

SHA512
04e808b0c62e8331bb6fd301d430c584ac6ca2b64c9bfb10cca3dacea9cdfbf9d1b09a6a8f7911734feffccef4fdd6fd6e12979e765cbb860db7f1e2e9f59483

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
e28ac43ea181bb12bbd33407b3cd7f4c

SHA1
72429e3f0c49b1f9d93a4cf2e74f06f6cf9c68e3

SHA256
dd5f73104709142433aa45324fbddda172f32ba38773e9a8c20f5e37f81274d9

SHA512
9f1f01a7167b8570b518402ff906a8097a665e457e0c37e7fd81d8348ff48aef8c3ce644075158b7f67f6dad4035f828226030ad0fee30249b9afa652f51a8bb

Download Submit
memory/216-1713-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/220-685-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/220-4213-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/220-103-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/324-4929-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/552-2829-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/552-3008-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/632-2388-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/836-4476-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/920-1546-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1252-2052-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1472-2109-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1472-2632-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1472-2543-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1544-3113-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1792-2941-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1792-2936-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1924-2236-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1924-2239-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1928-2732-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1928-2735-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1940-955-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1940-2063-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1960-4345-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1960-4667-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1996-104-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1996-98-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2036-1547-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2040-4450-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2332-1164-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2356-2724-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2356-2719-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2472-0-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/2472-49-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2472-42-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/2472-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2492-1026-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2492-2076-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2528-3102-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2528-4084-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2572-2088-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2592-2074-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2592-2079-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2816-3871-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2904-1417-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2916-3655-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2920-2552-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2924-2065-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/2924-2064-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2956-2958-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2960-2559-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3208-1098-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3224-2415-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3452-3533-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3572-1306-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3616-4073-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3620-2427-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3668-2054-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3668-2174-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3680-1842-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3712-2583-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3752-1780-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3848-2229-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3848-2226-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3932-2062-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3992-1494-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4064-2072-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4124-2572-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4300-1966-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4332-3190-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4344-1603-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4356-809-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4356-2055-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4364-2802-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4388-1944-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4412-2218-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4412-2214-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4416-1245-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4452-2521-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4632-3862-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4632-3988-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4684-2205-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4724-2099-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4844-92-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4844-45-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4844-44-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4888-5301-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4952-1027-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5080-2927-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5100-1656-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5180-5017-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5312-4775-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5380-4893-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5568-5040-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5692-5356-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5732-5062-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5872-5126-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6008-5123-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6008-4911-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6084-4922-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6140-5143-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6140-5273-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download