pony | d12f598816f44ebb53c11f05763699f7dbd1eed480a169a053994060da2e5a04

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe
Size

2.2MB
MD5

d61fa37e0935805c4f9cc8b5d8386a47
SHA1

7c53076dff57a6b56440edff0f58fa8222e6c7d8
SHA256

d12f598816f44ebb53c11f05763699f7dbd1eed480a169a053994060da2e5a04
SHA512

edceb17584c829649a3506929864e25b0fee76681c73cc52b59ca144339656565e917780907ee5297d6cdce1d0d84dab818e255ff2e6f4dc4a745167fef82e6b
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZt:0UzeyQMS4DqodCnoe+iitjWwwB

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe	d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe	d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1380	explorer.exe
4584	explorer.exe
5008	spoolsv.exe
2792	spoolsv.exe
2744	spoolsv.exe
4336	spoolsv.exe
1812	spoolsv.exe
1744	spoolsv.exe
448	spoolsv.exe
3740	spoolsv.exe
4908	spoolsv.exe
3224	spoolsv.exe
3048	spoolsv.exe
4036	spoolsv.exe
3316	spoolsv.exe
4604	spoolsv.exe
884	spoolsv.exe
2560	spoolsv.exe
1852	spoolsv.exe
4900	spoolsv.exe
524	spoolsv.exe
984	spoolsv.exe
4508	spoolsv.exe
4444	spoolsv.exe
1256	spoolsv.exe
1188	spoolsv.exe
3000	spoolsv.exe
4100	spoolsv.exe
4212	spoolsv.exe
840	spoolsv.exe
496	spoolsv.exe
3044	spoolsv.exe
3612	spoolsv.exe
4580	spoolsv.exe
1528	spoolsv.exe
4320	spoolsv.exe
224	explorer.exe
3412	spoolsv.exe
1560	spoolsv.exe
64	spoolsv.exe
4708	spoolsv.exe
3788	spoolsv.exe
5040	spoolsv.exe
2676	spoolsv.exe
3244	spoolsv.exe
1604	spoolsv.exe
4724	spoolsv.exe
1876	explorer.exe
1372	spoolsv.exe
3180	spoolsv.exe
3216	spoolsv.exe
2580	spoolsv.exe
2072	explorer.exe
3360	spoolsv.exe
4496	spoolsv.exe
4840	spoolsv.exe
1184	spoolsv.exe
4512	spoolsv.exe
2796	spoolsv.exe
1252	spoolsv.exe
3328	explorer.exe
4448	spoolsv.exe
2812	spoolsv.exe
2116	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 53 IoCs

description	pid	Process	procid_target
PID 732 set thread context of 1776	732	d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe	95
PID 1380 set thread context of 4584	1380	explorer.exe	99
PID 5008 set thread context of 4320	5008	spoolsv.exe	133
PID 2792 set thread context of 3412	2792	spoolsv.exe	135
PID 2744 set thread context of 1560	2744	spoolsv.exe	136
PID 4336 set thread context of 4708	4336	spoolsv.exe	138
PID 1812 set thread context of 3788	1812	spoolsv.exe	139
PID 1744 set thread context of 5040	1744	spoolsv.exe	140
PID 448 set thread context of 2676	448	spoolsv.exe	141
PID 3740 set thread context of 3244	3740	spoolsv.exe	142
PID 4908 set thread context of 4724	4908	spoolsv.exe	144
PID 3224 set thread context of 1372	3224	spoolsv.exe	146
PID 3048 set thread context of 3180	3048	spoolsv.exe	147
PID 4036 set thread context of 3216	4036	spoolsv.exe	148
PID 3316 set thread context of 2580	3316	spoolsv.exe	149
PID 4604 set thread context of 4496	4604	spoolsv.exe	152
PID 884 set thread context of 4840	884	spoolsv.exe	153
PID 2560 set thread context of 1184	2560	spoolsv.exe	154
PID 1852 set thread context of 4512	1852	spoolsv.exe	155
PID 4900 set thread context of 2796	4900	spoolsv.exe	156
PID 524 set thread context of 4448	524	spoolsv.exe	159
PID 984 set thread context of 2812	984	spoolsv.exe	160
PID 4508 set thread context of 2116	4508	spoolsv.exe	161
PID 4444 set thread context of 3028	4444	spoolsv.exe	163
PID 1256 set thread context of 2528	1256	spoolsv.exe	165
PID 1188 set thread context of 1616	1188	spoolsv.exe	166
PID 3000 set thread context of 4344	3000	spoolsv.exe	167
PID 4100 set thread context of 656	4100	spoolsv.exe	169
PID 4212 set thread context of 1924	4212	spoolsv.exe	171
PID 840 set thread context of 5068	840	spoolsv.exe	172
PID 496 set thread context of 3452	496	spoolsv.exe	173
PID 3044 set thread context of 3780	3044	spoolsv.exe	174
PID 3612 set thread context of 1040	3612	spoolsv.exe	176
PID 4580 set thread context of 5024	4580	spoolsv.exe	178
PID 1528 set thread context of 2856	1528	spoolsv.exe	181
PID 224 set thread context of 2044	224	explorer.exe	187
PID 64 set thread context of 1692	64	spoolsv.exe	188
PID 1876 set thread context of 1688	1876	explorer.exe	193
PID 1604 set thread context of 1396	1604	spoolsv.exe	194
PID 2072 set thread context of 1788	2072	explorer.exe	199
PID 3360 set thread context of 1564	3360	spoolsv.exe	200
PID 3328 set thread context of 4956	3328	explorer.exe	204
PID 1252 set thread context of 4428	1252	spoolsv.exe	205
PID 3512 set thread context of 2740	3512	spoolsv.exe	209
PID 3644 set thread context of 5080	3644	explorer.exe	211
PID 3160 set thread context of 3020	3160	spoolsv.exe	215
PID 548 set thread context of 2616	548	explorer.exe	217
PID 1948 set thread context of 652	1948	spoolsv.exe	218
PID 4160 set thread context of 3528	4160	explorer.exe	219
PID 2920 set thread context of 2612	2920	spoolsv.exe	221
PID 2136 set thread context of 2408	2136	spoolsv.exe	223
PID 1288 set thread context of 1360	1288	spoolsv.exe	224
PID 4128 set thread context of 4288	4128	explorer.exe	233

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1776	d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe
1776	d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4584	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1776	d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe
1776	d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4584	explorer.exe
4320	spoolsv.exe
4320	spoolsv.exe
3412	spoolsv.exe
3412	spoolsv.exe
1560	spoolsv.exe
1560	spoolsv.exe
4708	spoolsv.exe
4708	spoolsv.exe
3788	spoolsv.exe
3788	spoolsv.exe
5040	spoolsv.exe
5040	spoolsv.exe
2676	spoolsv.exe
2676	spoolsv.exe
3244	spoolsv.exe
3244	spoolsv.exe
4724	spoolsv.exe
4724	spoolsv.exe
1372	spoolsv.exe
1372	spoolsv.exe
3180	spoolsv.exe
3180	spoolsv.exe
3216	spoolsv.exe
3216	spoolsv.exe
2580	spoolsv.exe
2580	spoolsv.exe
4496	spoolsv.exe
4496	spoolsv.exe
4840	spoolsv.exe
4840	spoolsv.exe
1184	spoolsv.exe
1184	spoolsv.exe
4512	spoolsv.exe
4512	spoolsv.exe
2796	spoolsv.exe
2796	spoolsv.exe
4448	spoolsv.exe
4448	spoolsv.exe
2812	spoolsv.exe
2812	spoolsv.exe
2116	spoolsv.exe
2116	spoolsv.exe
3028	spoolsv.exe
3028	spoolsv.exe
2528	spoolsv.exe
2528	spoolsv.exe
1616	spoolsv.exe
1616	spoolsv.exe
4344	spoolsv.exe
4344	spoolsv.exe
656	spoolsv.exe
656	spoolsv.exe
1924	spoolsv.exe
1924	spoolsv.exe
5068	spoolsv.exe
5068	spoolsv.exe
3452	spoolsv.exe
3452	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 4804	732	d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe	83
PID 732 wrote to memory of 4804	732	d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe	83
PID 732 wrote to memory of 1776	732	d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe	95
PID 732 wrote to memory of 1776	732	d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe	95
PID 732 wrote to memory of 1776	732	d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe	95
PID 732 wrote to memory of 1776	732	d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe	95
PID 732 wrote to memory of 1776	732	d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe	95
PID 1776 wrote to memory of 1380	1776	d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe	96
PID 1776 wrote to memory of 1380	1776	d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe	96
PID 1776 wrote to memory of 1380	1776	d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe	96
PID 1380 wrote to memory of 4584	1380	explorer.exe	99
PID 1380 wrote to memory of 4584	1380	explorer.exe	99
PID 1380 wrote to memory of 4584	1380	explorer.exe	99
PID 1380 wrote to memory of 4584	1380	explorer.exe	99
PID 1380 wrote to memory of 4584	1380	explorer.exe	99
PID 4584 wrote to memory of 5008	4584	explorer.exe	100
PID 4584 wrote to memory of 5008	4584	explorer.exe	100
PID 4584 wrote to memory of 5008	4584	explorer.exe	100
PID 4584 wrote to memory of 2792	4584	explorer.exe	101
PID 4584 wrote to memory of 2792	4584	explorer.exe	101
PID 4584 wrote to memory of 2792	4584	explorer.exe	101
PID 4584 wrote to memory of 2744	4584	explorer.exe	102
PID 4584 wrote to memory of 2744	4584	explorer.exe	102
PID 4584 wrote to memory of 2744	4584	explorer.exe	102
PID 4584 wrote to memory of 4336	4584	explorer.exe	103
PID 4584 wrote to memory of 4336	4584	explorer.exe	103
PID 4584 wrote to memory of 4336	4584	explorer.exe	103
PID 4584 wrote to memory of 1812	4584	explorer.exe	104
PID 4584 wrote to memory of 1812	4584	explorer.exe	104
PID 4584 wrote to memory of 1812	4584	explorer.exe	104
PID 4584 wrote to memory of 1744	4584	explorer.exe	105
PID 4584 wrote to memory of 1744	4584	explorer.exe	105
PID 4584 wrote to memory of 1744	4584	explorer.exe	105
PID 4584 wrote to memory of 448	4584	explorer.exe	106
PID 4584 wrote to memory of 448	4584	explorer.exe	106
PID 4584 wrote to memory of 448	4584	explorer.exe	106
PID 4584 wrote to memory of 3740	4584	explorer.exe	107
PID 4584 wrote to memory of 3740	4584	explorer.exe	107
PID 4584 wrote to memory of 3740	4584	explorer.exe	107
PID 4584 wrote to memory of 4908	4584	explorer.exe	108
PID 4584 wrote to memory of 4908	4584	explorer.exe	108
PID 4584 wrote to memory of 4908	4584	explorer.exe	108
PID 4584 wrote to memory of 3224	4584	explorer.exe	109
PID 4584 wrote to memory of 3224	4584	explorer.exe	109
PID 4584 wrote to memory of 3224	4584	explorer.exe	109
PID 4584 wrote to memory of 3048	4584	explorer.exe	110
PID 4584 wrote to memory of 3048	4584	explorer.exe	110
PID 4584 wrote to memory of 3048	4584	explorer.exe	110
PID 4584 wrote to memory of 4036	4584	explorer.exe	111
PID 4584 wrote to memory of 4036	4584	explorer.exe	111
PID 4584 wrote to memory of 4036	4584	explorer.exe	111
PID 4584 wrote to memory of 3316	4584	explorer.exe	112
PID 4584 wrote to memory of 3316	4584	explorer.exe	112
PID 4584 wrote to memory of 3316	4584	explorer.exe	112
PID 4584 wrote to memory of 4604	4584	explorer.exe	113
PID 4584 wrote to memory of 4604	4584	explorer.exe	113
PID 4584 wrote to memory of 4604	4584	explorer.exe	113
PID 4584 wrote to memory of 884	4584	explorer.exe	114
PID 4584 wrote to memory of 884	4584	explorer.exe	114
PID 4584 wrote to memory of 884	4584	explorer.exe	114
PID 4584 wrote to memory of 2560	4584	explorer.exe	115
PID 4584 wrote to memory of 2560	4584	explorer.exe	115
PID 4584 wrote to memory of 2560	4584	explorer.exe	115
PID 4584 wrote to memory of 1852	4584	explorer.exe	116

C:\Users\Admin\AppData\Local\Temp\d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:732
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4804
- C:\Users\Admin\AppData\Local\Temp\d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d61fa37e0935805c4f9cc8b5d8386a47_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1776
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4320
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:224
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2744
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4336
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1812
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1744
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3740
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4908
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4724
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1876
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3224
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3048
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2580
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2072
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4604
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1852
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4900
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2796
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3328
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:524
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:984
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4508
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3028
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3644
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1188
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4100
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:656
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:548
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4212
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3612
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1040
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4160
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4580
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1528
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2856
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4128
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:64
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1692
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2428
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1604
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1396
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2508
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1564
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1252
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4428
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2740
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3160
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3020
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1948
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2612
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2136
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1288
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1764
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1860
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3532
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1504
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3200
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3592
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1784
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
73a8db55d8a47d16d4b0f570ca3c03b1

SHA1
726329c1d483d899931e567661930ec8cd8728bd

SHA256
5fabd127e97564d59fd4033d0d91076f6f993a537afb15f33458638184b31a9d

SHA512
5ea5c54b5b63acf1cd68546375d39eac43a008a4aaafba2895da580c3f08f3fd31d096b3f019f13b357eb29a8da6ab669a4f174c70bc6608bc7c8ac05f2409bc

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
f1e34365485a60d60d85ca6e218cbac3

SHA1
b0050199ca74dc2ee3cfce4b7e6a8fc40fe91075

SHA256
d7a19aae9cb9c6f67822f49b564aa6a13e6ebed161dac3eb659d3f61e5f8aa1a

SHA512
33dbb43bcfa19f0cd31725414e22831d39a4877bbce6149e472ad4539ff412e4f592ba316900e5bf1c99de059324b61a1f1c25f1ce0df22ab991ff5512540f4b

Download Submit
memory/180-5424-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/448-1377-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/524-2057-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/652-5266-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/656-3383-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/656-3205-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/732-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/732-49-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/732-0-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/732-42-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/884-1814-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/984-2124-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1040-3533-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1184-2735-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1188-2263-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1256-2212-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1360-5405-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1372-2541-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1380-105-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1380-111-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1396-4436-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1560-2264-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1564-4574-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1564-4698-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1616-3063-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1688-4318-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1692-4150-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1744-1331-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1764-5672-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1776-94-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1776-92-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/1776-45-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1776-44-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1788-4565-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1812-1270-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1852-1993-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1860-5711-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1860-5817-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1924-3214-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2044-4037-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2352-5972-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2528-3051-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2560-1901-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2580-2808-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2580-2659-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2612-5387-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2616-5258-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2676-2339-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2740-5070-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2740-4937-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2744-2244-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2744-1063-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2792-1062-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2792-2215-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2796-2890-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2812-2918-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2856-3861-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2952-5729-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3020-5236-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3028-3043-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3048-1637-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3180-2552-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3224-1525-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3244-2434-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3316-1700-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3412-2213-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3412-2217-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3452-3233-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3528-5277-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3592-5861-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3740-1378-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3788-2318-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4036-1699-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4288-5415-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4288-5721-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4320-2204-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4320-2432-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4336-1129-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4344-3073-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4384-5741-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4428-4789-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4444-2203-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4448-2911-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4448-2908-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4496-2714-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4508-2196-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4512-2746-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4512-2742-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4584-803-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4584-4573-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4584-110-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4604-1767-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4708-2309-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4720-5872-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4724-2533-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4724-2621-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4840-2722-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4900-1994-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4908-1439-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4956-4793-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5008-916-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5008-2205-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5024-3420-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5040-2329-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5040-5878-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5040-5882-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5080-4947-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download