pony | 523685c02e5ca2dce568a7f8d619b2f6a5fd9976dcbc5477c2e9b94404707eac

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe
Size

2.2MB
MD5

d14241e31cd698350657c4dfa45d41a0
SHA1

1ef79bb99097342c5d263616684b2b2da32cc54d
SHA256

523685c02e5ca2dce568a7f8d619b2f6a5fd9976dcbc5477c2e9b94404707eac
SHA512

1091a337ba335ce52b65b5a51676d6d14d345c9321799342472c4689b1add7a66b6d405a550228331412e092ac591c00c0c040cc8494201c99fbccc1fcc5fdad
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ8:0UzeyQMS4DqodCnoe+iitjWwwo

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe	d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe	d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1232	explorer.exe
2000	explorer.exe
2120	spoolsv.exe
1424	spoolsv.exe
4188	spoolsv.exe
1052	spoolsv.exe
3880	spoolsv.exe
928	spoolsv.exe
2220	spoolsv.exe
2416	spoolsv.exe
3672	spoolsv.exe
3096	spoolsv.exe
1896	spoolsv.exe
3988	spoolsv.exe
1268	spoolsv.exe
1708	spoolsv.exe
3584	spoolsv.exe
2348	spoolsv.exe
2984	spoolsv.exe
1768	spoolsv.exe
2824	spoolsv.exe
3380	spoolsv.exe
3456	spoolsv.exe
464	spoolsv.exe
3676	spoolsv.exe
3424	spoolsv.exe
4880	spoolsv.exe
4448	spoolsv.exe
4996	spoolsv.exe
3172	spoolsv.exe
1660	spoolsv.exe
2168	spoolsv.exe
3160	spoolsv.exe
1904	spoolsv.exe
624	spoolsv.exe
2020	spoolsv.exe
4488	spoolsv.exe
4560	spoolsv.exe
2328	explorer.exe
4868	spoolsv.exe
3688	spoolsv.exe
2960	spoolsv.exe
1912	spoolsv.exe
228	spoolsv.exe
4592	spoolsv.exe
4812	spoolsv.exe
2676	spoolsv.exe
1984	spoolsv.exe
4692	spoolsv.exe
3016	explorer.exe
3108	spoolsv.exe
4612	spoolsv.exe
756	spoolsv.exe
4904	spoolsv.exe
1584	spoolsv.exe
4728	spoolsv.exe
2332	spoolsv.exe
4876	spoolsv.exe
4820	spoolsv.exe
1760	spoolsv.exe
2276	spoolsv.exe
1152	explorer.exe
3468	spoolsv.exe
3680	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 60 IoCs

description	pid	Process	procid_target
PID 5076 set thread context of 3472	5076	d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe	92
PID 1232 set thread context of 2000	1232	explorer.exe	98
PID 2120 set thread context of 4560	2120	spoolsv.exe	134
PID 1424 set thread context of 4868	1424	spoolsv.exe	136
PID 4188 set thread context of 3688	4188	spoolsv.exe	137
PID 1052 set thread context of 2960	1052	spoolsv.exe	138
PID 3880 set thread context of 1912	3880	spoolsv.exe	139
PID 928 set thread context of 4592	928	spoolsv.exe	141
PID 2220 set thread context of 4812	2220	spoolsv.exe	142
PID 2416 set thread context of 2676	2416	spoolsv.exe	143
PID 3672 set thread context of 1984	3672	spoolsv.exe	144
PID 3096 set thread context of 4692	3096	spoolsv.exe	145
PID 1896 set thread context of 3108	1896	spoolsv.exe	147
PID 3988 set thread context of 4612	3988	spoolsv.exe	148
PID 1268 set thread context of 4904	1268	spoolsv.exe	150
PID 1708 set thread context of 1584	1708	spoolsv.exe	151
PID 3584 set thread context of 4728	3584	spoolsv.exe	152
PID 2348 set thread context of 2332	2348	spoolsv.exe	153
PID 2984 set thread context of 4876	2984	spoolsv.exe	154
PID 1768 set thread context of 4820	1768	spoolsv.exe	155
PID 2824 set thread context of 2276	2824	spoolsv.exe	157
PID 3380 set thread context of 3468	3380	spoolsv.exe	159
PID 3456 set thread context of 3680	3456	spoolsv.exe	160
PID 464 set thread context of 4856	464	spoolsv.exe	161
PID 3676 set thread context of 2832	3676	spoolsv.exe	162
PID 3424 set thread context of 2872	3424	spoolsv.exe	163
PID 4880 set thread context of 2108	4880	spoolsv.exe	164
PID 4448 set thread context of 244	4448	spoolsv.exe	166
PID 4996 set thread context of 5068	4996	spoolsv.exe	168
PID 3172 set thread context of 3572	3172	spoolsv.exe	169
PID 1660 set thread context of 3628	1660	spoolsv.exe	170
PID 2168 set thread context of 3328	2168	spoolsv.exe	171
PID 3160 set thread context of 1576	3160	spoolsv.exe	173
PID 1904 set thread context of 2484	1904	spoolsv.exe	174
PID 624 set thread context of 4280	624	spoolsv.exe	176
PID 2020 set thread context of 4300	2020	spoolsv.exe	177
PID 4488 set thread context of 4952	4488	spoolsv.exe	182
PID 2328 set thread context of 4088	2328	explorer.exe	186
PID 228 set thread context of 4752	228	spoolsv.exe	190
PID 3016 set thread context of 3936	3016	explorer.exe	196
PID 756 set thread context of 548	756	spoolsv.exe	198
PID 1760 set thread context of 2860	1760	spoolsv.exe	204
PID 1152 set thread context of 3476	1152	explorer.exe	206
PID 4516 set thread context of 5264	4516	spoolsv.exe	211
PID 1004 set thread context of 5376	1004	explorer.exe	213
PID 3644 set thread context of 6056	3644	spoolsv.exe	215
PID 2180 set thread context of 180	2180	explorer.exe	217
PID 4408 set thread context of 5400	4408	spoolsv.exe	219
PID 2524 set thread context of 5468	2524	spoolsv.exe	220
PID 1800 set thread context of 5544	1800	spoolsv.exe	221
PID 1048 set thread context of 5056	1048	spoolsv.exe	223
PID 1132 set thread context of 4868	1132	explorer.exe	225
PID 1292 set thread context of 5180	1292	spoolsv.exe	226
PID 4964 set thread context of 5312	4964	spoolsv.exe	228
PID 3660 set thread context of 5940	3660	spoolsv.exe	230
PID 1748 set thread context of 3356	1748	spoolsv.exe	232
PID 4924 set thread context of 5192	4924	explorer.exe	233
PID 1168 set thread context of 5452	1168	spoolsv.exe	234
PID 1560 set thread context of 5560	1560	spoolsv.exe	236
PID 1488 set thread context of 5984	1488	spoolsv.exe	238

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3472	d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe
3472	d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2000	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3472	d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe
3472	d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
4560	spoolsv.exe
4560	spoolsv.exe
4868	spoolsv.exe
4868	spoolsv.exe
3688	spoolsv.exe
3688	spoolsv.exe
2960	spoolsv.exe
2960	spoolsv.exe
1912	spoolsv.exe
1912	spoolsv.exe
4592	spoolsv.exe
4592	spoolsv.exe
4812	spoolsv.exe
4812	spoolsv.exe
2676	spoolsv.exe
2676	spoolsv.exe
1984	spoolsv.exe
1984	spoolsv.exe
4692	spoolsv.exe
4692	spoolsv.exe
3108	spoolsv.exe
3108	spoolsv.exe
4612	spoolsv.exe
4612	spoolsv.exe
4904	spoolsv.exe
4904	spoolsv.exe
1584	spoolsv.exe
1584	spoolsv.exe
4728	spoolsv.exe
4728	spoolsv.exe
2332	spoolsv.exe
2332	spoolsv.exe
4876	spoolsv.exe
4876	spoolsv.exe
4820	spoolsv.exe
4820	spoolsv.exe
2276	spoolsv.exe
2276	spoolsv.exe
3468	spoolsv.exe
3468	spoolsv.exe
3680	spoolsv.exe
3680	spoolsv.exe
4856	spoolsv.exe
4856	spoolsv.exe
2832	spoolsv.exe
2832	spoolsv.exe
2872	spoolsv.exe
2872	spoolsv.exe
2108	spoolsv.exe
2108	spoolsv.exe
244	spoolsv.exe
244	spoolsv.exe
5068	spoolsv.exe
5068	spoolsv.exe
3572	spoolsv.exe
3572	spoolsv.exe
3628	spoolsv.exe
3628	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 4568	5076	d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe	83
PID 5076 wrote to memory of 4568	5076	d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe	83
PID 5076 wrote to memory of 3472	5076	d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe	92
PID 5076 wrote to memory of 3472	5076	d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe	92
PID 5076 wrote to memory of 3472	5076	d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe	92
PID 5076 wrote to memory of 3472	5076	d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe	92
PID 5076 wrote to memory of 3472	5076	d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe	92
PID 3472 wrote to memory of 1232	3472	d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe	93
PID 3472 wrote to memory of 1232	3472	d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe	93
PID 3472 wrote to memory of 1232	3472	d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe	93
PID 1232 wrote to memory of 2000	1232	explorer.exe	98
PID 1232 wrote to memory of 2000	1232	explorer.exe	98
PID 1232 wrote to memory of 2000	1232	explorer.exe	98
PID 1232 wrote to memory of 2000	1232	explorer.exe	98
PID 1232 wrote to memory of 2000	1232	explorer.exe	98
PID 2000 wrote to memory of 2120	2000	explorer.exe	99
PID 2000 wrote to memory of 2120	2000	explorer.exe	99
PID 2000 wrote to memory of 2120	2000	explorer.exe	99
PID 2000 wrote to memory of 1424	2000	explorer.exe	100
PID 2000 wrote to memory of 1424	2000	explorer.exe	100
PID 2000 wrote to memory of 1424	2000	explorer.exe	100
PID 2000 wrote to memory of 4188	2000	explorer.exe	101
PID 2000 wrote to memory of 4188	2000	explorer.exe	101
PID 2000 wrote to memory of 4188	2000	explorer.exe	101
PID 2000 wrote to memory of 1052	2000	explorer.exe	102
PID 2000 wrote to memory of 1052	2000	explorer.exe	102
PID 2000 wrote to memory of 1052	2000	explorer.exe	102
PID 2000 wrote to memory of 3880	2000	explorer.exe	103
PID 2000 wrote to memory of 3880	2000	explorer.exe	103
PID 2000 wrote to memory of 3880	2000	explorer.exe	103
PID 2000 wrote to memory of 928	2000	explorer.exe	104
PID 2000 wrote to memory of 928	2000	explorer.exe	104
PID 2000 wrote to memory of 928	2000	explorer.exe	104
PID 2000 wrote to memory of 2220	2000	explorer.exe	105
PID 2000 wrote to memory of 2220	2000	explorer.exe	105
PID 2000 wrote to memory of 2220	2000	explorer.exe	105
PID 2000 wrote to memory of 2416	2000	explorer.exe	106
PID 2000 wrote to memory of 2416	2000	explorer.exe	106
PID 2000 wrote to memory of 2416	2000	explorer.exe	106
PID 2000 wrote to memory of 3672	2000	explorer.exe	107
PID 2000 wrote to memory of 3672	2000	explorer.exe	107
PID 2000 wrote to memory of 3672	2000	explorer.exe	107
PID 2000 wrote to memory of 3096	2000	explorer.exe	108
PID 2000 wrote to memory of 3096	2000	explorer.exe	108
PID 2000 wrote to memory of 3096	2000	explorer.exe	108
PID 2000 wrote to memory of 1896	2000	explorer.exe	109
PID 2000 wrote to memory of 1896	2000	explorer.exe	109
PID 2000 wrote to memory of 1896	2000	explorer.exe	109
PID 2000 wrote to memory of 3988	2000	explorer.exe	110
PID 2000 wrote to memory of 3988	2000	explorer.exe	110
PID 2000 wrote to memory of 3988	2000	explorer.exe	110
PID 2000 wrote to memory of 1268	2000	explorer.exe	111
PID 2000 wrote to memory of 1268	2000	explorer.exe	111
PID 2000 wrote to memory of 1268	2000	explorer.exe	111
PID 2000 wrote to memory of 1708	2000	explorer.exe	112
PID 2000 wrote to memory of 1708	2000	explorer.exe	112
PID 2000 wrote to memory of 1708	2000	explorer.exe	112
PID 2000 wrote to memory of 3584	2000	explorer.exe	113
PID 2000 wrote to memory of 3584	2000	explorer.exe	113
PID 2000 wrote to memory of 3584	2000	explorer.exe	113
PID 2000 wrote to memory of 2348	2000	explorer.exe	114
PID 2000 wrote to memory of 2348	2000	explorer.exe	114
PID 2000 wrote to memory of 2348	2000	explorer.exe	114
PID 2000 wrote to memory of 2984	2000	explorer.exe	115

C:\Users\Admin\AppData\Local\Temp\d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4568
- C:\Users\Admin\AppData\Local\Temp\d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d14241e31cd698350657c4dfa45d41a0_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3472
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4560
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2328
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4088
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4188
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3880
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2416
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3672
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3096
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4692
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3016
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1896
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3988
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1268
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2348
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2984
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2824
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2276
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1152
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4880
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:244
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1004
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4996
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3172
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1660
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2168
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3160
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2484
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2180
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:624
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4488
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4952
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:1132
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4752
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4924
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:756
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:548
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1760
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2860
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4516
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5264
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6056
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:6092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4408
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2524
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1800
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1048
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5056
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5312
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3660
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1168
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5452
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1488
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
228debd5a22ad147ed3617e0d7ca9b00

SHA1
afd907c7b716280ec143b5a41486981bed327b68

SHA256
963f60d57fa9a50ecd48546018f0a4caec130fc10e317ebf1902e89b97bf4c49

SHA512
d19974271366b5806d42617b2d7f728dcc52b0c60689b27abdffd2f6403af7118b74c80820c6145c5afe96bcc6a76db0f816891fcd43afa534eb4cbf729d2f2d

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
07b7ad17660541e4ddefb22fd4f6072a

SHA1
9a94960a44ece7f72d2f66c8c1aa52abf666d4cc

SHA256
f5da104284260f6c87eaa19c49549d77e2abf1b930579f1094e47bc60aaaef62

SHA512
81d93b879c58cdd5204d14842d7ef77784bc97d48655d5badc899c69af914cbef320dfa43e23b14fe54ca8481fe452bff16bde601404e0aa17324df180a4c5d9

Download Submit
memory/180-5393-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/244-3143-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/244-3290-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/464-2294-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/548-4565-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/928-1344-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1052-1262-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1232-94-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1232-89-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1268-1858-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1424-1085-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1424-2378-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1576-3244-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1584-2743-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1584-2748-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1708-1859-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1768-2087-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1896-1669-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1912-2415-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1912-2412-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1984-2559-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2000-4578-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2000-918-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2000-93-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2108-3020-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2108-3029-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2120-2369-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2120-1019-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2220-1400-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2276-2951-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2276-3117-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2348-1978-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2416-1522-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2484-3344-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2484-3450-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2676-2519-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2676-2515-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2824-2159-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2832-2992-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2860-4926-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2860-4787-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2872-2999-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2960-2404-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2960-2399-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2984-2086-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3096-1608-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3108-2619-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3328-3180-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3328-3184-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3356-5842-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3380-2236-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3424-2373-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3456-2293-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3472-78-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3472-45-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3472-44-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3476-4798-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3572-3163-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3584-1916-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3628-3174-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3672-1607-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3676-2362-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3680-2967-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3680-2972-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3688-2390-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3688-2391-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/3880-1343-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3936-4366-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3988-1746-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4088-3905-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4188-2386-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4188-1146-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4280-3350-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4300-3362-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4560-2368-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4592-2496-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4612-2714-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4692-2843-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4692-2610-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4728-2757-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4752-4149-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4812-2503-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4812-2508-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4820-2794-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4856-2979-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4868-5598-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4868-2380-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4876-2776-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4880-2389-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4904-2734-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4952-3829-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5056-5589-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5056-5732-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5068-3153-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5076-0-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/5076-47-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5076-42-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/5076-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5180-5609-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5180-5604-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5192-5881-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5264-5289-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5312-5915-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5376-5186-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5400-5414-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5400-5410-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5452-5934-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5468-5420-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5544-5491-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5544-5451-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5560-5941-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5560-5944-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5940-5769-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5984-6029-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6056-5323-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6056-5543-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download