pony | a8bb3f4aeae9f565145868b3a81daffeb8d66b9d1551d3637ece8534dcbe79cd

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe
Size

2.2MB
MD5

d523c46aba3ef8487ba0a5a033a8cb73
SHA1

d133ee76c1b4a86f7f95a7d9ced1aa9525dda422
SHA256

a8bb3f4aeae9f565145868b3a81daffeb8d66b9d1551d3637ece8534dcbe79cd
SHA512

c93fd823d2412e65187e7a72fc7a036221244d1affc2dfb306a4ce5271cf5d27ff679f4af5d66e8e875583a132a92e7f663e3914abae3486653a2321ee7558f7
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ7:0UzeyQMS4DqodCnoe+iitjWwwv

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe	d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe	d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
5112	explorer.exe
2852	explorer.exe
2580	spoolsv.exe
1548	spoolsv.exe
3980	spoolsv.exe
3248	spoolsv.exe
5012	spoolsv.exe
820	spoolsv.exe
3112	spoolsv.exe
4900	spoolsv.exe
1164	spoolsv.exe
3124	spoolsv.exe
3108	spoolsv.exe
2676	spoolsv.exe
2420	spoolsv.exe
4328	spoolsv.exe
1460	spoolsv.exe
3464	spoolsv.exe
1072	spoolsv.exe
4984	spoolsv.exe
3404	spoolsv.exe
4728	spoolsv.exe
5044	spoolsv.exe
3704	spoolsv.exe
4240	spoolsv.exe
1756	spoolsv.exe
728	spoolsv.exe
3480	spoolsv.exe
2596	spoolsv.exe
3912	spoolsv.exe
524	spoolsv.exe
2200	spoolsv.exe
4104	spoolsv.exe
4692	spoolsv.exe
2016	spoolsv.exe
2124	spoolsv.exe
1296	spoolsv.exe
1952	spoolsv.exe
1612	spoolsv.exe
3580	spoolsv.exe
1360	explorer.exe
3920	spoolsv.exe
4668	spoolsv.exe
2092	spoolsv.exe
3400	spoolsv.exe
4004	spoolsv.exe
4420	spoolsv.exe
2160	spoolsv.exe
368	spoolsv.exe
2504	spoolsv.exe
1564	spoolsv.exe
2628	explorer.exe
1732	spoolsv.exe
4360	spoolsv.exe
3388	spoolsv.exe
2916	spoolsv.exe
4952	spoolsv.exe
2312	spoolsv.exe
4380	spoolsv.exe
3180	spoolsv.exe
1068	spoolsv.exe
1680	spoolsv.exe
4252	spoolsv.exe
2740	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 52 IoCs

description	pid	Process	procid_target
PID 4596 set thread context of 4048	4596	d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe	98
PID 5112 set thread context of 2852	5112	explorer.exe	102
PID 2580 set thread context of 3580	2580	spoolsv.exe	140
PID 1548 set thread context of 3920	1548	spoolsv.exe	142
PID 3980 set thread context of 4668	3980	spoolsv.exe	143
PID 3248 set thread context of 2092	3248	spoolsv.exe	144
PID 5012 set thread context of 3400	5012	spoolsv.exe	145
PID 820 set thread context of 4004	820	spoolsv.exe	146
PID 3112 set thread context of 4420	3112	spoolsv.exe	147
PID 4900 set thread context of 2160	4900	spoolsv.exe	148
PID 1164 set thread context of 2504	1164	spoolsv.exe	150
PID 3124 set thread context of 1564	3124	spoolsv.exe	151
PID 3108 set thread context of 1732	3108	spoolsv.exe	153
PID 2676 set thread context of 4360	2676	spoolsv.exe	154
PID 2420 set thread context of 3388	2420	spoolsv.exe	155
PID 4328 set thread context of 2916	4328	spoolsv.exe	156
PID 1460 set thread context of 4952	1460	spoolsv.exe	157
PID 3464 set thread context of 2312	3464	spoolsv.exe	158
PID 1072 set thread context of 4380	1072	spoolsv.exe	159
PID 4984 set thread context of 3180	4984	spoolsv.exe	160
PID 3404 set thread context of 1068	3404	spoolsv.exe	161
PID 4728 set thread context of 4252	4728	spoolsv.exe	163
PID 5044 set thread context of 1848	5044	spoolsv.exe	165
PID 3704 set thread context of 3100	3704	spoolsv.exe	166
PID 4240 set thread context of 3608	4240	spoolsv.exe	167
PID 1756 set thread context of 3568	1756	spoolsv.exe	168
PID 728 set thread context of 208	728	spoolsv.exe	169
PID 3480 set thread context of 3320	3480	spoolsv.exe	170
PID 2596 set thread context of 3128	2596	spoolsv.exe	171
PID 3912 set thread context of 2196	3912	spoolsv.exe	172
PID 524 set thread context of 5060	524	spoolsv.exe	173
PID 2200 set thread context of 4336	2200	spoolsv.exe	175
PID 4104 set thread context of 2088	4104	spoolsv.exe	176
PID 4692 set thread context of 116	4692	spoolsv.exe	178
PID 2016 set thread context of 4436	2016	spoolsv.exe	179
PID 2124 set thread context of 4548	2124	spoolsv.exe	180
PID 1296 set thread context of 544	1296	spoolsv.exe	181
PID 1952 set thread context of 2560	1952	spoolsv.exe	183
PID 1612 set thread context of 1388	1612	spoolsv.exe	191
PID 1360 set thread context of 2060	1360	explorer.exe	194
PID 2628 set thread context of 1504	2628	explorer.exe	201
PID 368 set thread context of 3184	368	spoolsv.exe	202
PID 1680 set thread context of 3996	1680	spoolsv.exe	214
PID 2740 set thread context of 2824	2740	explorer.exe	217
PID 5052 set thread context of 1008	5052	spoolsv.exe	220
PID 3076 set thread context of 5192	3076	explorer.exe	222
PID 3956 set thread context of 5396	3956	spoolsv.exe	224
PID 2544 set thread context of 5452	2544	explorer.exe	225
PID 2364 set thread context of 5512	2364	spoolsv.exe	226
PID 4784 set thread context of 5596	4784	spoolsv.exe	227
PID 3564 set thread context of 5672	3564	spoolsv.exe	228
PID 4180 set thread context of 5148	4180	spoolsv.exe	230

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4048	d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe
4048	d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2852	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4048	d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe
4048	d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
3580	spoolsv.exe
3580	spoolsv.exe
3920	spoolsv.exe
3920	spoolsv.exe
4668	spoolsv.exe
4668	spoolsv.exe
2092	spoolsv.exe
2092	spoolsv.exe
3400	spoolsv.exe
3400	spoolsv.exe
4004	spoolsv.exe
4004	spoolsv.exe
4420	spoolsv.exe
4420	spoolsv.exe
2160	spoolsv.exe
2160	spoolsv.exe
2504	spoolsv.exe
2504	spoolsv.exe
1564	spoolsv.exe
1564	spoolsv.exe
1732	spoolsv.exe
1732	spoolsv.exe
4360	spoolsv.exe
4360	spoolsv.exe
3388	spoolsv.exe
3388	spoolsv.exe
2916	spoolsv.exe
2916	spoolsv.exe
4952	spoolsv.exe
4952	spoolsv.exe
2312	spoolsv.exe
2312	spoolsv.exe
4380	spoolsv.exe
4380	spoolsv.exe
3180	spoolsv.exe
3180	spoolsv.exe
1068	spoolsv.exe
1068	spoolsv.exe
4252	spoolsv.exe
4252	spoolsv.exe
1848	spoolsv.exe
1848	spoolsv.exe
3100	spoolsv.exe
3100	spoolsv.exe
3608	spoolsv.exe
3608	spoolsv.exe
3568	spoolsv.exe
3568	spoolsv.exe
208	spoolsv.exe
208	spoolsv.exe
3320	spoolsv.exe
3320	spoolsv.exe
3128	spoolsv.exe
3128	spoolsv.exe
2196	spoolsv.exe
2196	spoolsv.exe
5060	spoolsv.exe
5060	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 3040	4596	d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe	85
PID 4596 wrote to memory of 3040	4596	d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe	85
PID 4596 wrote to memory of 4048	4596	d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe	98
PID 4596 wrote to memory of 4048	4596	d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe	98
PID 4596 wrote to memory of 4048	4596	d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe	98
PID 4596 wrote to memory of 4048	4596	d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe	98
PID 4596 wrote to memory of 4048	4596	d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe	98
PID 4048 wrote to memory of 5112	4048	d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe	99
PID 4048 wrote to memory of 5112	4048	d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe	99
PID 4048 wrote to memory of 5112	4048	d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe	99
PID 5112 wrote to memory of 2852	5112	explorer.exe	102
PID 5112 wrote to memory of 2852	5112	explorer.exe	102
PID 5112 wrote to memory of 2852	5112	explorer.exe	102
PID 5112 wrote to memory of 2852	5112	explorer.exe	102
PID 5112 wrote to memory of 2852	5112	explorer.exe	102
PID 2852 wrote to memory of 2580	2852	explorer.exe	103
PID 2852 wrote to memory of 2580	2852	explorer.exe	103
PID 2852 wrote to memory of 2580	2852	explorer.exe	103
PID 2852 wrote to memory of 1548	2852	explorer.exe	104
PID 2852 wrote to memory of 1548	2852	explorer.exe	104
PID 2852 wrote to memory of 1548	2852	explorer.exe	104
PID 2852 wrote to memory of 3980	2852	explorer.exe	105
PID 2852 wrote to memory of 3980	2852	explorer.exe	105
PID 2852 wrote to memory of 3980	2852	explorer.exe	105
PID 2852 wrote to memory of 3248	2852	explorer.exe	106
PID 2852 wrote to memory of 3248	2852	explorer.exe	106
PID 2852 wrote to memory of 3248	2852	explorer.exe	106
PID 2852 wrote to memory of 5012	2852	explorer.exe	107
PID 2852 wrote to memory of 5012	2852	explorer.exe	107
PID 2852 wrote to memory of 5012	2852	explorer.exe	107
PID 2852 wrote to memory of 820	2852	explorer.exe	108
PID 2852 wrote to memory of 820	2852	explorer.exe	108
PID 2852 wrote to memory of 820	2852	explorer.exe	108
PID 2852 wrote to memory of 3112	2852	explorer.exe	109
PID 2852 wrote to memory of 3112	2852	explorer.exe	109
PID 2852 wrote to memory of 3112	2852	explorer.exe	109
PID 2852 wrote to memory of 4900	2852	explorer.exe	110
PID 2852 wrote to memory of 4900	2852	explorer.exe	110
PID 2852 wrote to memory of 4900	2852	explorer.exe	110
PID 2852 wrote to memory of 1164	2852	explorer.exe	111
PID 2852 wrote to memory of 1164	2852	explorer.exe	111
PID 2852 wrote to memory of 1164	2852	explorer.exe	111
PID 2852 wrote to memory of 3124	2852	explorer.exe	112
PID 2852 wrote to memory of 3124	2852	explorer.exe	112
PID 2852 wrote to memory of 3124	2852	explorer.exe	112
PID 2852 wrote to memory of 3108	2852	explorer.exe	113
PID 2852 wrote to memory of 3108	2852	explorer.exe	113
PID 2852 wrote to memory of 3108	2852	explorer.exe	113
PID 2852 wrote to memory of 2676	2852	explorer.exe	114
PID 2852 wrote to memory of 2676	2852	explorer.exe	114
PID 2852 wrote to memory of 2676	2852	explorer.exe	114
PID 2852 wrote to memory of 2420	2852	explorer.exe	115
PID 2852 wrote to memory of 2420	2852	explorer.exe	115
PID 2852 wrote to memory of 2420	2852	explorer.exe	115
PID 2852 wrote to memory of 4328	2852	explorer.exe	116
PID 2852 wrote to memory of 4328	2852	explorer.exe	116
PID 2852 wrote to memory of 4328	2852	explorer.exe	116
PID 2852 wrote to memory of 1460	2852	explorer.exe	117
PID 2852 wrote to memory of 1460	2852	explorer.exe	117
PID 2852 wrote to memory of 1460	2852	explorer.exe	117
PID 2852 wrote to memory of 3464	2852	explorer.exe	118
PID 2852 wrote to memory of 3464	2852	explorer.exe	118
PID 2852 wrote to memory of 3464	2852	explorer.exe	118
PID 2852 wrote to memory of 1072	2852	explorer.exe	119

C:\Users\Admin\AppData\Local\Temp\d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3040
- C:\Users\Admin\AppData\Local\Temp\d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d523c46aba3ef8487ba0a5a033a8cb73_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4048
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2580
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3580
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1360
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1548
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3980
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3248
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:820
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4900
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3124
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1564
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2628
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2420
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1460
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1072
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4984
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3404
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4728
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4252
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2740
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3704
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4240
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1756
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:728
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3480
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3912
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:524
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2200
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2088
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3076
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2124
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1296
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2560
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2544
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1612
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1388
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4332
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:368
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3184
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1680
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3996
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1008
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4784
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4180
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5148
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3612
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2908
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3460
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5520
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4704
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3136
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4764
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5316
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3172
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:6112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:6000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
91a455a4f13dae6da35201e0b68b6afd

SHA1
63b94e2072f7bdb0b1423fc887e826200e62aa3e

SHA256
b85bcc76c7527fe94730bdbf8dd6a66cb72d883901e75933dabec399518e82bb

SHA512
ee2afb8e2b5d0dad5b855480c6e80fffc97c4392f4aa5f915fdea8594edf7bed19a453c13cd9f4f831c525207ea93f53f8061692f9b2249addbd7d7a3c3d292f

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
04d0cb5b99ed6613b9a7f4de4c2263e2

SHA1
0614eec0c825f4429864f4a63992c15269dfb54b

SHA256
192cf7fb2b85114107808723c5faef293c56e3eebee40fc70fd52edd4b07422f

SHA512
299f0c7dc3a25a6b1f1d05d2170981dce2c37a668de212fe36a7957cba58cb6a98d8d9cb03371c45f623c72a84fdc516ca9982f4cef120a071bc91ad900b5884

Download Submit
memory/208-2924-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/544-3173-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/544-3170-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/728-2415-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/820-1329-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1008-5267-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1068-2821-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1072-1979-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1164-1572-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1460-1926-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1504-4303-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1548-2427-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1548-1081-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1564-2646-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1564-2819-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1732-2656-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1756-2408-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2060-3874-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2088-3297-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2088-3140-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2092-2447-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2196-2954-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2312-2709-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2420-1757-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2504-2565-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2560-3432-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2580-2417-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2580-985-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2596-2436-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2676-1756-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2824-5139-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2852-84-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2852-4376-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2852-899-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2908-5659-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2916-2688-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3100-2897-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3108-1644-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3112-1395-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3124-1573-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3128-2943-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3180-2729-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3184-4519-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3248-1217-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3388-2678-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3400-2457-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3404-2169-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3464-1927-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3480-2435-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3580-2416-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3580-2628-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3608-2906-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3704-2320-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3920-2423-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/3920-2425-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3980-1157-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3996-5036-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4004-2467-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4048-68-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4048-30-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4048-29-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4240-2321-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4252-2880-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4252-3124-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4328-1834-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4360-2667-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4400-5746-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4420-2478-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4436-3154-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4596-35-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4596-27-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/4596-26-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4596-0-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/4668-2437-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4728-2170-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4900-1486-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4952-2697-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4984-2056-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5012-1328-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5044-2242-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5112-79-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5112-85-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5148-5506-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5192-5331-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5316-6177-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5316-6048-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5396-5339-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5452-5350-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5512-5359-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5520-6000-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5596-5370-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5668-6122-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5668-6125-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5672-5377-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5960-5939-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5960-5943-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6096-5951-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6096-5953-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download