pony | c52d42aac3dbc9ded905a1d69859790177831f224d3d181c50aecfd3a4651579

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2024 08:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe
Size

2.2MB
MD5

d3f32d8b372f950d7879a85b9e36c0b3
SHA1

23ae8f398897323acbf0b78fcee40529c65d3af5
SHA256

c52d42aac3dbc9ded905a1d69859790177831f224d3d181c50aecfd3a4651579
SHA512

a9bd0bba6167b790e4ebe106a4bef58655ca6c8d121dc58a03c2f8c99f75f8a6c56da1074d1505a6b8f22fab48954eaec5c4d4313cac0f0298ecefad60aa3164
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZS:0UzeyQMS4DqodCnoe+iitjWww2

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
3752	explorer.exe
2120	explorer.exe
1112	spoolsv.exe
2476	spoolsv.exe
4176	spoolsv.exe
220	spoolsv.exe
4872	spoolsv.exe
1808	spoolsv.exe
1508	spoolsv.exe
1924	spoolsv.exe
3540	spoolsv.exe
5008	spoolsv.exe
1844	spoolsv.exe
5088	spoolsv.exe
4952	spoolsv.exe
3208	spoolsv.exe
2924	spoolsv.exe
2768	spoolsv.exe
1492	spoolsv.exe
1584	spoolsv.exe
4500	spoolsv.exe
1264	spoolsv.exe
3720	spoolsv.exe
904	spoolsv.exe
1616	spoolsv.exe
1328	spoolsv.exe
2960	spoolsv.exe
4920	spoolsv.exe
2332	spoolsv.exe
4864	spoolsv.exe
3692	spoolsv.exe
1324	spoolsv.exe
544	spoolsv.exe
1192	spoolsv.exe
3624	spoolsv.exe
5104	spoolsv.exe
3796	spoolsv.exe
3904	spoolsv.exe
1256	explorer.exe
4936	spoolsv.exe
2560	spoolsv.exe
4596	spoolsv.exe
2024	spoolsv.exe
2608	spoolsv.exe
2124	spoolsv.exe
1896	spoolsv.exe
3424	spoolsv.exe
3948	explorer.exe
4320	spoolsv.exe
924	spoolsv.exe
4808	spoolsv.exe
1540	spoolsv.exe
4512	spoolsv.exe
4092	spoolsv.exe
4680	explorer.exe
2468	spoolsv.exe
3816	spoolsv.exe
4712	spoolsv.exe
2620	spoolsv.exe
3196	spoolsv.exe
1224	spoolsv.exe
2392	spoolsv.exe
1496	spoolsv.exe
5040	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 58 IoCs

description	pid	Process	procid_target
PID 3720 set thread context of 1184	3720	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe	97
PID 3752 set thread context of 2120	3752	explorer.exe	101
PID 1112 set thread context of 3904	1112	spoolsv.exe	137
PID 2476 set thread context of 4936	2476	spoolsv.exe	139
PID 4176 set thread context of 4596	4176	spoolsv.exe	141
PID 220 set thread context of 2024	220	spoolsv.exe	142
PID 4872 set thread context of 2608	4872	spoolsv.exe	143
PID 1808 set thread context of 2124	1808	spoolsv.exe	144
PID 1508 set thread context of 3424	1508	spoolsv.exe	146
PID 1924 set thread context of 4320	1924	spoolsv.exe	148
PID 3540 set thread context of 924	3540	spoolsv.exe	149
PID 5008 set thread context of 4808	5008	spoolsv.exe	150
PID 1844 set thread context of 1540	1844	spoolsv.exe	151
PID 5088 set thread context of 4512	5088	spoolsv.exe	152
PID 4952 set thread context of 4092	4952	spoolsv.exe	153
PID 3208 set thread context of 3816	3208	spoolsv.exe	156
PID 2924 set thread context of 4712	2924	spoolsv.exe	157
PID 2768 set thread context of 2620	2768	spoolsv.exe	158
PID 1492 set thread context of 3196	1492	spoolsv.exe	159
PID 1584 set thread context of 1224	1584	spoolsv.exe	160
PID 4500 set thread context of 2392	4500	spoolsv.exe	161
PID 1264 set thread context of 1496	1264	spoolsv.exe	162
PID 3720 set thread context of 452	3720	spoolsv.exe	164
PID 904 set thread context of 4012	904	spoolsv.exe	166
PID 1616 set thread context of 1012	1616	spoolsv.exe	167
PID 1328 set thread context of 5116	1328	spoolsv.exe	168
PID 2960 set thread context of 2764	2960	spoolsv.exe	169
PID 4920 set thread context of 3564	4920	spoolsv.exe	170
PID 2332 set thread context of 3276	2332	spoolsv.exe	172
PID 4864 set thread context of 3312	4864	spoolsv.exe	174
PID 3692 set thread context of 4740	3692	spoolsv.exe	175
PID 1324 set thread context of 1344	1324	spoolsv.exe	176
PID 544 set thread context of 3592	544	spoolsv.exe	178
PID 1192 set thread context of 2636	1192	spoolsv.exe	179
PID 3624 set thread context of 1996	3624	spoolsv.exe	181
PID 5104 set thread context of 3292	5104	spoolsv.exe	182
PID 3796 set thread context of 2692	3796	spoolsv.exe	186
PID 1256 set thread context of 928	1256	explorer.exe	190
PID 2560 set thread context of 4436	2560	spoolsv.exe	191
PID 3948 set thread context of 2028	3948	explorer.exe	197
PID 1896 set thread context of 1736	1896	spoolsv.exe	198
PID 2468 set thread context of 3676	2468	spoolsv.exe	204
PID 4680 set thread context of 3700	4680	explorer.exe	206
PID 2284 set thread context of 3544	2284	explorer.exe	209
PID 5040 set thread context of 400	5040	spoolsv.exe	210
PID 3436 set thread context of 60	3436	spoolsv.exe	215
PID 812 set thread context of 2776	812	explorer.exe	218
PID 3808 set thread context of 4148	3808	spoolsv.exe	219
PID 3480 set thread context of 1528	3480	explorer.exe	221
PID 4280 set thread context of 2148	4280	spoolsv.exe	223
PID 4840 set thread context of 2756	4840	spoolsv.exe	224
PID 4584 set thread context of 2888	4584	spoolsv.exe	225
PID 3660 set thread context of 3288	3660	explorer.exe	226
PID 4496 set thread context of 2016	4496	spoolsv.exe	227
PID 1608 set thread context of 1544	1608	spoolsv.exe	229
PID 1688 set thread context of 1352	1688	explorer.exe	231
PID 4252 set thread context of 3532	4252	spoolsv.exe	232
PID 3980 set thread context of 116	3980	spoolsv.exe	233

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1184	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe
1184	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2120	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1184	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe
1184	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
2120	explorer.exe
3904	spoolsv.exe
3904	spoolsv.exe
4936	spoolsv.exe
4936	spoolsv.exe
4596	spoolsv.exe
4596	spoolsv.exe
2024	spoolsv.exe
2024	spoolsv.exe
2608	spoolsv.exe
2608	spoolsv.exe
2124	spoolsv.exe
2124	spoolsv.exe
3424	spoolsv.exe
3424	spoolsv.exe
4320	spoolsv.exe
4320	spoolsv.exe
4808	spoolsv.exe
4808	spoolsv.exe
1540	spoolsv.exe
1540	spoolsv.exe
4512	spoolsv.exe
4512	spoolsv.exe
4092	spoolsv.exe
4092	spoolsv.exe
3816	spoolsv.exe
3816	spoolsv.exe
4712	spoolsv.exe
4712	spoolsv.exe
2620	spoolsv.exe
2620	spoolsv.exe
3196	spoolsv.exe
3196	spoolsv.exe
1224	spoolsv.exe
1224	spoolsv.exe
2392	spoolsv.exe
2392	spoolsv.exe
1496	spoolsv.exe
1496	spoolsv.exe
452	spoolsv.exe
452	spoolsv.exe
4012	spoolsv.exe
4012	spoolsv.exe
1012	spoolsv.exe
1012	spoolsv.exe
5116	spoolsv.exe
5116	spoolsv.exe
2764	spoolsv.exe
2764	spoolsv.exe
3564	spoolsv.exe
3564	spoolsv.exe
3276	spoolsv.exe
3276	spoolsv.exe
3312	spoolsv.exe
3312	spoolsv.exe
4740	spoolsv.exe
4740	spoolsv.exe
1344	spoolsv.exe
1344	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 3884	3720	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe	88
PID 3720 wrote to memory of 3884	3720	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe	88
PID 3720 wrote to memory of 1184	3720	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe	97
PID 3720 wrote to memory of 1184	3720	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe	97
PID 3720 wrote to memory of 1184	3720	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe	97
PID 3720 wrote to memory of 1184	3720	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe	97
PID 3720 wrote to memory of 1184	3720	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe	97
PID 1184 wrote to memory of 3752	1184	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe	98
PID 1184 wrote to memory of 3752	1184	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe	98
PID 1184 wrote to memory of 3752	1184	d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe	98
PID 3752 wrote to memory of 2120	3752	explorer.exe	101
PID 3752 wrote to memory of 2120	3752	explorer.exe	101
PID 3752 wrote to memory of 2120	3752	explorer.exe	101
PID 3752 wrote to memory of 2120	3752	explorer.exe	101
PID 3752 wrote to memory of 2120	3752	explorer.exe	101
PID 2120 wrote to memory of 1112	2120	explorer.exe	102
PID 2120 wrote to memory of 1112	2120	explorer.exe	102
PID 2120 wrote to memory of 1112	2120	explorer.exe	102
PID 2120 wrote to memory of 2476	2120	explorer.exe	103
PID 2120 wrote to memory of 2476	2120	explorer.exe	103
PID 2120 wrote to memory of 2476	2120	explorer.exe	103
PID 2120 wrote to memory of 4176	2120	explorer.exe	104
PID 2120 wrote to memory of 4176	2120	explorer.exe	104
PID 2120 wrote to memory of 4176	2120	explorer.exe	104
PID 2120 wrote to memory of 220	2120	explorer.exe	105
PID 2120 wrote to memory of 220	2120	explorer.exe	105
PID 2120 wrote to memory of 220	2120	explorer.exe	105
PID 2120 wrote to memory of 4872	2120	explorer.exe	106
PID 2120 wrote to memory of 4872	2120	explorer.exe	106
PID 2120 wrote to memory of 4872	2120	explorer.exe	106
PID 2120 wrote to memory of 1808	2120	explorer.exe	107
PID 2120 wrote to memory of 1808	2120	explorer.exe	107
PID 2120 wrote to memory of 1808	2120	explorer.exe	107
PID 2120 wrote to memory of 1508	2120	explorer.exe	108
PID 2120 wrote to memory of 1508	2120	explorer.exe	108
PID 2120 wrote to memory of 1508	2120	explorer.exe	108
PID 2120 wrote to memory of 1924	2120	explorer.exe	109
PID 2120 wrote to memory of 1924	2120	explorer.exe	109
PID 2120 wrote to memory of 1924	2120	explorer.exe	109
PID 2120 wrote to memory of 3540	2120	explorer.exe	110
PID 2120 wrote to memory of 3540	2120	explorer.exe	110
PID 2120 wrote to memory of 3540	2120	explorer.exe	110
PID 2120 wrote to memory of 5008	2120	explorer.exe	111
PID 2120 wrote to memory of 5008	2120	explorer.exe	111
PID 2120 wrote to memory of 5008	2120	explorer.exe	111
PID 2120 wrote to memory of 1844	2120	explorer.exe	112
PID 2120 wrote to memory of 1844	2120	explorer.exe	112
PID 2120 wrote to memory of 1844	2120	explorer.exe	112
PID 2120 wrote to memory of 5088	2120	explorer.exe	113
PID 2120 wrote to memory of 5088	2120	explorer.exe	113
PID 2120 wrote to memory of 5088	2120	explorer.exe	113
PID 2120 wrote to memory of 4952	2120	explorer.exe	114
PID 2120 wrote to memory of 4952	2120	explorer.exe	114
PID 2120 wrote to memory of 4952	2120	explorer.exe	114
PID 2120 wrote to memory of 3208	2120	explorer.exe	115
PID 2120 wrote to memory of 3208	2120	explorer.exe	115
PID 2120 wrote to memory of 3208	2120	explorer.exe	115
PID 2120 wrote to memory of 2924	2120	explorer.exe	116
PID 2120 wrote to memory of 2924	2120	explorer.exe	116
PID 2120 wrote to memory of 2924	2120	explorer.exe	116
PID 2120 wrote to memory of 2768	2120	explorer.exe	117
PID 2120 wrote to memory of 2768	2120	explorer.exe	117
PID 2120 wrote to memory of 2768	2120	explorer.exe	117
PID 2120 wrote to memory of 1492	2120	explorer.exe	118

C:\Users\Admin\AppData\Local\Temp\d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3884
- C:\Users\Admin\AppData\Local\Temp\d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d3f32d8b372f950d7879a85b9e36c0b3_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1184
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3752
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3904
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1256
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2476
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4176
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1808
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1508
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3424
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3948
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1924
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        
        PID:924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1844
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4092
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4680
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2924
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4500
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1264
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3720
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:452
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:2284
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1616
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2960
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3276
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:812
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4864
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1324
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1192
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2636
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3480
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3624
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3796
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2692
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3660
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1688
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1896
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1736
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:728
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2468
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3676
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:400
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:60
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3808
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4148
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4280
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1544
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4252
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3980
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1532
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1704
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2280
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
85de06750a0a23ed064ee852f52c3445

SHA1
7cf4e99d4c38544e8d68569a6364b50d83c739eb

SHA256
60cf38d7db6a4b52505e76e3424a4e75aa845ebd3f71ed0dd7f8794138d92081

SHA512
8441628134de5437a3cb0028b7ae53a8e7a8361e6be07160ffca17332016e0274df37bfd2de3b5436e7697251eb3376eeb6186a3073d06149c87116e357576b1

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
748782a704cd48b3087e21a200f9cf88

SHA1
5dc1d03d932f73fc07d1485a1d3321609a97aea5

SHA256
2c2904befebec52b0be94cd21180ce2e21eddfa293bdc74dd6146e9b6f2e9edb

SHA512
db8d42c2e628a3c7204b354aed1a78cfd0c1c35024c26d7d663e1ce67a31ce8cc115fb630a8d05cc130f1724de80d18b0969bc21d076934261db8819794b9102

Download Submit
memory/60-5098-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/60-4964-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/220-1213-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/400-4862-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/452-3103-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/904-2356-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/928-3881-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1012-3120-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1012-3124-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1112-2365-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1112-935-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1184-49-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1184-83-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1184-50-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1224-2928-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1224-2924-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1264-2222-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1328-2371-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1492-2021-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1496-2948-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1496-2944-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1508-1361-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1528-5195-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1540-2698-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1544-5555-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1544-5408-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1584-2022-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1616-2357-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1704-5762-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1704-5696-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1736-4304-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1808-1295-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1844-1650-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1924-1452-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1996-3405-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2016-5244-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2016-5239-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2024-2457-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2028-4190-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2052-5517-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2120-4504-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2120-864-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2120-99-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2124-2476-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2124-2481-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2148-5202-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2392-2934-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2476-2377-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2476-1046-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2608-2467-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2620-2909-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2636-3396-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2692-3788-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2756-5212-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2764-3142-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2764-3145-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2768-1944-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2776-5051-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2776-5047-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2924-1867-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2960-2440-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3196-2916-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3208-1866-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3276-3249-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3288-5230-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3292-3417-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3312-3256-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3424-2782-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3424-2651-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3532-5426-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3540-1563-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3544-4755-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3596-5714-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3676-4512-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3700-4521-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3720-2344-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3720-46-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3720-0-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/3720-53-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3720-47-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/3752-94-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3752-100-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3816-2885-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3904-2564-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3904-2364-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4012-3113-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4012-3109-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4092-2816-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4092-3073-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4148-5120-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4176-1107-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4176-2445-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4320-2670-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4436-3965-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4500-2140-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4512-2708-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4596-2447-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4712-2896-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4808-2686-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4872-1294-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4936-2374-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/4936-2373-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4936-2376-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4952-1794-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5008-1649-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5088-1702-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5116-3135-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5116-3130-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download