pony | 2aa0319344c3883f40a7459292b7be75c569fa9ad43d6971591a616dd0253ebd

Analysis

max time kernel
144s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 07:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe
Size

2.2MB
MD5

d5e497cb8763b2aecd661750a8099076
SHA1

f13e28be32a210fcdcb7798d9ce62768da979c36
SHA256

2aa0319344c3883f40a7459292b7be75c569fa9ad43d6971591a616dd0253ebd
SHA512

ebdf89ec7bdb4006c27bede84c639cec39d44093d14c87d39b44a3049ded03e295640034562f57f01c176eda33249e471fe4370af10e34a704fdd20eecb07e4c
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZR:0UzeyQMS4DqodCnoe+iitjWww9

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe	d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe	d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
3768	explorer.exe
1944	explorer.exe
3688	spoolsv.exe
4044	spoolsv.exe
4812	spoolsv.exe
3132	spoolsv.exe
4808	spoolsv.exe
4004	spoolsv.exe
4504	spoolsv.exe
1220	spoolsv.exe
3456	spoolsv.exe
2916	spoolsv.exe
3156	spoolsv.exe
4688	spoolsv.exe
4764	spoolsv.exe
4416	spoolsv.exe
4928	spoolsv.exe
4400	spoolsv.exe
1096	spoolsv.exe
3012	spoolsv.exe
3684	spoolsv.exe
1464	spoolsv.exe
3764	spoolsv.exe
2068	spoolsv.exe
4068	spoolsv.exe
1356	spoolsv.exe
4796	spoolsv.exe
1796	spoolsv.exe
4820	spoolsv.exe
4172	spoolsv.exe
2320	spoolsv.exe
3160	spoolsv.exe
3092	spoolsv.exe
4896	spoolsv.exe
2152	spoolsv.exe
1572	spoolsv.exe
5068	spoolsv.exe
4212	spoolsv.exe
2844	explorer.exe
4016	spoolsv.exe
2292	spoolsv.exe
4500	spoolsv.exe
3720	spoolsv.exe
1276	spoolsv.exe
1480	spoolsv.exe
3076	spoolsv.exe
4792	spoolsv.exe
2372	spoolsv.exe
4436	explorer.exe
2760	spoolsv.exe
4972	spoolsv.exe
4804	spoolsv.exe
3244	spoolsv.exe
3040	spoolsv.exe
2544	spoolsv.exe
4352	spoolsv.exe
4228	spoolsv.exe
1136	spoolsv.exe
3552	spoolsv.exe
716	spoolsv.exe
3068	explorer.exe
3784	spoolsv.exe
4588	spoolsv.exe
2720	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 54 IoCs

description	pid	Process	procid_target
PID 4080 set thread context of 4040	4080	d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe	95
PID 3768 set thread context of 1944	3768	explorer.exe	99
PID 3688 set thread context of 4212	3688	spoolsv.exe	135
PID 4044 set thread context of 4016	4044	spoolsv.exe	137
PID 4812 set thread context of 4500	4812	spoolsv.exe	139
PID 3132 set thread context of 3720	3132	spoolsv.exe	140
PID 4808 set thread context of 1276	4808	spoolsv.exe	141
PID 4004 set thread context of 1480	4004	spoolsv.exe	142
PID 4504 set thread context of 3076	4504	spoolsv.exe	143
PID 1220 set thread context of 4792	1220	spoolsv.exe	144
PID 3456 set thread context of 2372	3456	spoolsv.exe	145
PID 2916 set thread context of 2760	2916	spoolsv.exe	147
PID 3156 set thread context of 4804	3156	spoolsv.exe	149
PID 4688 set thread context of 3244	4688	spoolsv.exe	150
PID 4764 set thread context of 3040	4764	spoolsv.exe	151
PID 4416 set thread context of 2544	4416	spoolsv.exe	152
PID 4928 set thread context of 4352	4928	spoolsv.exe	153
PID 4400 set thread context of 4228	4400	spoolsv.exe	154
PID 1096 set thread context of 1136	1096	spoolsv.exe	155
PID 3012 set thread context of 3552	3012	spoolsv.exe	156
PID 3684 set thread context of 716	3684	spoolsv.exe	157
PID 1464 set thread context of 4588	1464	spoolsv.exe	160
PID 3764 set thread context of 2720	3764	spoolsv.exe	161
PID 2068 set thread context of 1720	2068	spoolsv.exe	162
PID 4068 set thread context of 4368	4068	spoolsv.exe	163
PID 1356 set thread context of 464	1356	spoolsv.exe	164
PID 4796 set thread context of 4520	4796	spoolsv.exe	165
PID 1796 set thread context of 1212	1796	spoolsv.exe	167
PID 4820 set thread context of 4824	4820	spoolsv.exe	169
PID 4172 set thread context of 2744	4172	spoolsv.exe	170
PID 2320 set thread context of 348	2320	spoolsv.exe	171
PID 3160 set thread context of 3928	3160	spoolsv.exe	172
PID 3092 set thread context of 3196	3092	spoolsv.exe	174
PID 4896 set thread context of 4872	4896	spoolsv.exe	176
PID 2152 set thread context of 760	2152	spoolsv.exe	177
PID 1572 set thread context of 1828	1572	spoolsv.exe	178
PID 5068 set thread context of 4120	5068	spoolsv.exe	181
PID 2844 set thread context of 4840	2844	explorer.exe	187
PID 2292 set thread context of 4336	2292	spoolsv.exe	189
PID 4436 set thread context of 4752	4436	explorer.exe	197
PID 4972 set thread context of 2784	4972	spoolsv.exe	199
PID 3784 set thread context of 4168	3784	spoolsv.exe	205
PID 3068 set thread context of 2236	3068	explorer.exe	206
PID 400 set thread context of 5104	400	spoolsv.exe	212
PID 4900 set thread context of 684	4900	explorer.exe	214
PID 2636 set thread context of 5224	2636	spoolsv.exe	217
PID 4632 set thread context of 5304	4632	explorer.exe	219
PID 4980 set thread context of 5744	4980	spoolsv.exe	221
PID 2092 set thread context of 452	2092	spoolsv.exe	222
PID 2024 set thread context of 5160	2024	explorer.exe	224
PID 4268 set thread context of 4148	4268	spoolsv.exe	225
PID 2548 set thread context of 5076	2548	spoolsv.exe	226
PID 4508 set thread context of 5924	4508	spoolsv.exe	228
PID 1128 set thread context of 5316	1128	spoolsv.exe	231

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4040	d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe
4040	d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1944	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4040	d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe
4040	d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
4212	spoolsv.exe
4212	spoolsv.exe
4016	spoolsv.exe
4016	spoolsv.exe
4500	spoolsv.exe
4500	spoolsv.exe
3720	spoolsv.exe
3720	spoolsv.exe
1276	spoolsv.exe
1276	spoolsv.exe
1480	spoolsv.exe
1480	spoolsv.exe
3076	spoolsv.exe
3076	spoolsv.exe
4792	spoolsv.exe
4792	spoolsv.exe
2372	spoolsv.exe
2372	spoolsv.exe
2760	spoolsv.exe
2760	spoolsv.exe
4804	spoolsv.exe
4804	spoolsv.exe
3244	spoolsv.exe
3244	spoolsv.exe
3040	spoolsv.exe
3040	spoolsv.exe
2544	spoolsv.exe
2544	spoolsv.exe
4352	spoolsv.exe
4352	spoolsv.exe
4228	spoolsv.exe
4228	spoolsv.exe
1136	spoolsv.exe
1136	spoolsv.exe
3552	spoolsv.exe
3552	spoolsv.exe
716	spoolsv.exe
716	spoolsv.exe
4588	spoolsv.exe
4588	spoolsv.exe
2720	spoolsv.exe
2720	spoolsv.exe
1720	spoolsv.exe
1720	spoolsv.exe
4368	spoolsv.exe
4368	spoolsv.exe
464	spoolsv.exe
464	spoolsv.exe
4520	spoolsv.exe
4520	spoolsv.exe
1212	spoolsv.exe
1212	spoolsv.exe
4824	spoolsv.exe
4824	spoolsv.exe
2744	spoolsv.exe
2744	spoolsv.exe
348	spoolsv.exe
348	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 3488	4080	d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe	83
PID 4080 wrote to memory of 3488	4080	d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe	83
PID 4080 wrote to memory of 4040	4080	d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe	95
PID 4080 wrote to memory of 4040	4080	d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe	95
PID 4080 wrote to memory of 4040	4080	d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe	95
PID 4080 wrote to memory of 4040	4080	d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe	95
PID 4080 wrote to memory of 4040	4080	d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe	95
PID 4040 wrote to memory of 3768	4040	d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe	96
PID 4040 wrote to memory of 3768	4040	d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe	96
PID 4040 wrote to memory of 3768	4040	d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe	96
PID 3768 wrote to memory of 1944	3768	explorer.exe	99
PID 3768 wrote to memory of 1944	3768	explorer.exe	99
PID 3768 wrote to memory of 1944	3768	explorer.exe	99
PID 3768 wrote to memory of 1944	3768	explorer.exe	99
PID 3768 wrote to memory of 1944	3768	explorer.exe	99
PID 1944 wrote to memory of 3688	1944	explorer.exe	100
PID 1944 wrote to memory of 3688	1944	explorer.exe	100
PID 1944 wrote to memory of 3688	1944	explorer.exe	100
PID 1944 wrote to memory of 4044	1944	explorer.exe	101
PID 1944 wrote to memory of 4044	1944	explorer.exe	101
PID 1944 wrote to memory of 4044	1944	explorer.exe	101
PID 1944 wrote to memory of 4812	1944	explorer.exe	102
PID 1944 wrote to memory of 4812	1944	explorer.exe	102
PID 1944 wrote to memory of 4812	1944	explorer.exe	102
PID 1944 wrote to memory of 3132	1944	explorer.exe	103
PID 1944 wrote to memory of 3132	1944	explorer.exe	103
PID 1944 wrote to memory of 3132	1944	explorer.exe	103
PID 1944 wrote to memory of 4808	1944	explorer.exe	104
PID 1944 wrote to memory of 4808	1944	explorer.exe	104
PID 1944 wrote to memory of 4808	1944	explorer.exe	104
PID 1944 wrote to memory of 4004	1944	explorer.exe	105
PID 1944 wrote to memory of 4004	1944	explorer.exe	105
PID 1944 wrote to memory of 4004	1944	explorer.exe	105
PID 1944 wrote to memory of 4504	1944	explorer.exe	106
PID 1944 wrote to memory of 4504	1944	explorer.exe	106
PID 1944 wrote to memory of 4504	1944	explorer.exe	106
PID 1944 wrote to memory of 1220	1944	explorer.exe	107
PID 1944 wrote to memory of 1220	1944	explorer.exe	107
PID 1944 wrote to memory of 1220	1944	explorer.exe	107
PID 1944 wrote to memory of 3456	1944	explorer.exe	108
PID 1944 wrote to memory of 3456	1944	explorer.exe	108
PID 1944 wrote to memory of 3456	1944	explorer.exe	108
PID 1944 wrote to memory of 2916	1944	explorer.exe	109
PID 1944 wrote to memory of 2916	1944	explorer.exe	109
PID 1944 wrote to memory of 2916	1944	explorer.exe	109
PID 1944 wrote to memory of 3156	1944	explorer.exe	110
PID 1944 wrote to memory of 3156	1944	explorer.exe	110
PID 1944 wrote to memory of 3156	1944	explorer.exe	110
PID 1944 wrote to memory of 4688	1944	explorer.exe	111
PID 1944 wrote to memory of 4688	1944	explorer.exe	111
PID 1944 wrote to memory of 4688	1944	explorer.exe	111
PID 1944 wrote to memory of 4764	1944	explorer.exe	112
PID 1944 wrote to memory of 4764	1944	explorer.exe	112
PID 1944 wrote to memory of 4764	1944	explorer.exe	112
PID 1944 wrote to memory of 4416	1944	explorer.exe	113
PID 1944 wrote to memory of 4416	1944	explorer.exe	113
PID 1944 wrote to memory of 4416	1944	explorer.exe	113
PID 1944 wrote to memory of 4928	1944	explorer.exe	114
PID 1944 wrote to memory of 4928	1944	explorer.exe	114
PID 1944 wrote to memory of 4928	1944	explorer.exe	114
PID 1944 wrote to memory of 4400	1944	explorer.exe	115
PID 1944 wrote to memory of 4400	1944	explorer.exe	115
PID 1944 wrote to memory of 4400	1944	explorer.exe	115
PID 1944 wrote to memory of 1096	1944	explorer.exe	116

C:\Users\Admin\AppData\Local\Temp\d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3488
- C:\Users\Admin\AppData\Local\Temp\d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d5e497cb8763b2aecd661750a8099076_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4040
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4212
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2844
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4812
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3132
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4808
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4004
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4504
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2372
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4436
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2916
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3156
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4764
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4416
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1096
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:716
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3068
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2236
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3764
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1356
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4796
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1796
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1212
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4900
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4820
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4172
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2320
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3160
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3196
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4632
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4896
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2152
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4120
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2024
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4336
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1592
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4972
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2784
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3784
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4168
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5104
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2636
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5224
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4980
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:452
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4268
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2548
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4508
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5924
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5236
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1128
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5316
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4140
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1556
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2172
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5232
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1620
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
dba47d8596be67b45856419e634882de

SHA1
4c0d7a0de77bb1102038737284cff739c969ec04

SHA256
270176ce65e5290019a2970a3a061a6f2c1b64e7a9190e6c6a20053411dd6027

SHA512
92605d95869aa21eb1c2779d543472ea3b9fd926c70e22f8076ed89176f1814f6e24e9b4ec8e77dde962b971c619f89e3ceb9670bc870f98d45b6c76d41b2bdc

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
0bdd39544bff0c91293a2211d617dbbe

SHA1
31aaea2acc553bc9f3e2a36a4a118cc21ae63c5e

SHA256
d97630ecfc2fd35f690d8ef231bcb444fa975bb076341a68f422782c59270afe

SHA512
9c5a575faaa3061d033cd86b8b59305a8c81afddb97e5ad57cfb4621a1e697f754bc41c73f23ff10f9ab46ee32e450aad5a3d2dc8f46df6ee97a48394bae8252

Download Submit
memory/348-3055-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/452-5653-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/452-5509-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/464-2941-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/684-5102-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/716-2875-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/716-3004-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/760-3245-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/760-3249-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1096-1992-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1136-2709-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1212-3200-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1220-1475-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1276-2432-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1356-2325-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1464-2204-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1480-2438-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1720-2920-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1796-2407-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1944-4520-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1944-99-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1944-834-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2068-2308-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2236-4738-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2372-2784-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2372-2546-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2544-2681-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2720-2909-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2744-3043-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2744-3047-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2784-4508-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2916-1547-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3012-2064-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3076-2449-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3132-1211-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3156-1612-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3196-3230-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3196-3360-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3244-2660-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3456-1546-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3552-2750-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3684-2132-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3688-2317-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3688-965-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3720-2420-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3764-2307-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3768-100-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3768-95-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3928-3093-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3928-3117-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4004-1278-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4016-2326-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4040-84-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4040-44-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4040-45-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4040-82-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/4044-1031-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4044-2328-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4068-2313-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4080-42-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/4080-0-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/4080-47-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4080-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4120-3576-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4148-5529-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4212-2316-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4212-2528-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4352-2689-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4368-2931-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4400-1991-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4416-1807-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4500-2408-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4504-1369-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4588-2899-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4688-1720-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4752-4328-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4764-1806-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4792-2458-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4796-2401-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4804-2649-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4808-1277-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4812-1125-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4824-3031-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4824-3035-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4840-3795-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4928-1864-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5076-5536-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5104-5091-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5160-5520-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5224-5301-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5224-5480-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5232-6061-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5232-6191-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5304-5311-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5316-5846-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5508-5868-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5544-6158-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5576-5878-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5744-5405-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download