pony | 372888a3a6a9460ffe242b651ef04a92ad7237657fceb86d709c6a5560980b61

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 17:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe
Size

2.2MB
MD5

d6d362ab7c508c5c660037b918b579e0
SHA1

214c67e69bbf98d1cae9a15e14aa575fe47ee555
SHA256

372888a3a6a9460ffe242b651ef04a92ad7237657fceb86d709c6a5560980b61
SHA512

f6311a24a9f013df2a34be6ed578bd451e3daacc092f9b5197393f8c2d7b4b97182be715740afedff47a62544bfc62290dd1d1ba1640e3023d6cb7c8e4c99056
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZw:0UzeyQMS4DqodCnoe+iitjWwwM

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe	d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe	d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1604	explorer.exe
1180	explorer.exe
3540	spoolsv.exe
3492	spoolsv.exe
4652	spoolsv.exe
3204	spoolsv.exe
2304	spoolsv.exe
540	spoolsv.exe
864	spoolsv.exe
5080	spoolsv.exe
3844	spoolsv.exe
5008	spoolsv.exe
3404	spoolsv.exe
3620	spoolsv.exe
1220	spoolsv.exe
4552	spoolsv.exe
3684	spoolsv.exe
3628	spoolsv.exe
3264	spoolsv.exe
4976	spoolsv.exe
3988	spoolsv.exe
5092	spoolsv.exe
3260	spoolsv.exe
3044	spoolsv.exe
4688	spoolsv.exe
4600	spoolsv.exe
668	spoolsv.exe
2292	spoolsv.exe
3992	spoolsv.exe
1364	spoolsv.exe
1672	spoolsv.exe
372	spoolsv.exe
2748	spoolsv.exe
2412	spoolsv.exe
3760	spoolsv.exe
3792	spoolsv.exe
3624	spoolsv.exe
4664	spoolsv.exe
3688	explorer.exe
656	spoolsv.exe
1076	spoolsv.exe
2892	spoolsv.exe
4776	spoolsv.exe
4448	spoolsv.exe
2992	spoolsv.exe
892	spoolsv.exe
4592	spoolsv.exe
4112	explorer.exe
4364	spoolsv.exe
672	spoolsv.exe
3964	spoolsv.exe
836	spoolsv.exe
4104	spoolsv.exe
2276	spoolsv.exe
4800	spoolsv.exe
3504	spoolsv.exe
1064	spoolsv.exe
800	explorer.exe
2616	spoolsv.exe
5096	spoolsv.exe
4200	spoolsv.exe
748	spoolsv.exe
5032	spoolsv.exe
1028	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 57 IoCs

description	pid	Process	procid_target
PID 4064 set thread context of 4560	4064	d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe	95
PID 1604 set thread context of 1180	1604	explorer.exe	99
PID 3540 set thread context of 4664	3540	spoolsv.exe	135
PID 3492 set thread context of 656	3492	spoolsv.exe	137
PID 4652 set thread context of 1076	4652	spoolsv.exe	138
PID 3204 set thread context of 2892	3204	spoolsv.exe	139
PID 2304 set thread context of 4776	2304	spoolsv.exe	140
PID 540 set thread context of 2992	540	spoolsv.exe	142
PID 864 set thread context of 892	864	spoolsv.exe	143
PID 5080 set thread context of 4592	5080	spoolsv.exe	144
PID 3844 set thread context of 4364	3844	spoolsv.exe	146
PID 5008 set thread context of 672	5008	spoolsv.exe	147
PID 3404 set thread context of 3964	3404	spoolsv.exe	148
PID 3620 set thread context of 4104	3620	spoolsv.exe	150
PID 1220 set thread context of 2276	1220	spoolsv.exe	151
PID 4552 set thread context of 4800	4552	spoolsv.exe	152
PID 3684 set thread context of 3504	3684	spoolsv.exe	153
PID 3628 set thread context of 1064	3628	spoolsv.exe	154
PID 3264 set thread context of 2616	3264	spoolsv.exe	156
PID 4976 set thread context of 4200	4976	spoolsv.exe	158
PID 3988 set thread context of 748	3988	spoolsv.exe	159
PID 5092 set thread context of 5032	5092	spoolsv.exe	160
PID 3260 set thread context of 1028	3260	spoolsv.exe	161
PID 3044 set thread context of 1580	3044	spoolsv.exe	162
PID 4688 set thread context of 4968	4688	spoolsv.exe	163
PID 4600 set thread context of 5068	4600	spoolsv.exe	164
PID 668 set thread context of 3216	668	spoolsv.exe	165
PID 2292 set thread context of 1088	2292	spoolsv.exe	166
PID 3992 set thread context of 3668	3992	spoolsv.exe	168
PID 1364 set thread context of 4452	1364	spoolsv.exe	170
PID 1672 set thread context of 2036	1672	spoolsv.exe	171
PID 372 set thread context of 4660	372	spoolsv.exe	172
PID 2748 set thread context of 1632	2748	spoolsv.exe	173
PID 2412 set thread context of 3292	2412	spoolsv.exe	174
PID 3760 set thread context of 4616	3760	spoolsv.exe	176
PID 3792 set thread context of 1452	3792	spoolsv.exe	178
PID 3624 set thread context of 4596	3624	spoolsv.exe	183
PID 3688 set thread context of 2232	3688	explorer.exe	186
PID 4448 set thread context of 4236	4448	spoolsv.exe	189
PID 4112 set thread context of 3012	4112	explorer.exe	193
PID 836 set thread context of 4092	836	spoolsv.exe	196
PID 800 set thread context of 3632	800	explorer.exe	206
PID 5096 set thread context of 2552	5096	spoolsv.exe	207
PID 5104 set thread context of 4004	5104	explorer.exe	214
PID 4956 set thread context of 2044	4956	spoolsv.exe	216
PID 5028 set thread context of 1548	5028	explorer.exe	218
PID 3240 set thread context of 464	3240	spoolsv.exe	219
PID 4740 set thread context of 3360	4740	spoolsv.exe	221
PID 3612 set thread context of 5200	3612	spoolsv.exe	223
PID 208 set thread context of 5516	208	spoolsv.exe	226
PID 2532 set thread context of 5696	2532	explorer.exe	227
PID 3140 set thread context of 5848	3140	spoolsv.exe	228
PID 1956 set thread context of 1452	1956	spoolsv.exe	230
PID 2932 set thread context of 5688	2932	spoolsv.exe	233
PID 3800 set thread context of 6088	3800	spoolsv.exe	234
PID 4608 set thread context of 4436	4608	explorer.exe	236
PID 5112 set thread context of 2936	5112	spoolsv.exe	238

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4560	d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe
4560	d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1180	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4560	d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe
4560	d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
1180	explorer.exe
4664	spoolsv.exe
4664	spoolsv.exe
656	spoolsv.exe
656	spoolsv.exe
1076	spoolsv.exe
1076	spoolsv.exe
2892	spoolsv.exe
2892	spoolsv.exe
4776	spoolsv.exe
4776	spoolsv.exe
2992	spoolsv.exe
2992	spoolsv.exe
892	spoolsv.exe
892	spoolsv.exe
4592	spoolsv.exe
4592	spoolsv.exe
4364	spoolsv.exe
4364	spoolsv.exe
672	spoolsv.exe
672	spoolsv.exe
3964	spoolsv.exe
3964	spoolsv.exe
4104	spoolsv.exe
4104	spoolsv.exe
2276	spoolsv.exe
2276	spoolsv.exe
4800	spoolsv.exe
4800	spoolsv.exe
3504	spoolsv.exe
3504	spoolsv.exe
1064	spoolsv.exe
1064	spoolsv.exe
2616	spoolsv.exe
2616	spoolsv.exe
4200	spoolsv.exe
4200	spoolsv.exe
748	spoolsv.exe
748	spoolsv.exe
5032	spoolsv.exe
5032	spoolsv.exe
1028	spoolsv.exe
1028	spoolsv.exe
1580	spoolsv.exe
1580	spoolsv.exe
4968	spoolsv.exe
4968	spoolsv.exe
5068	spoolsv.exe
5068	spoolsv.exe
3216	spoolsv.exe
3216	spoolsv.exe
1088	spoolsv.exe
1088	spoolsv.exe
3668	spoolsv.exe
3668	spoolsv.exe
4452	spoolsv.exe
4452	spoolsv.exe
2036	spoolsv.exe
2036	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 3328	4064	d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe	83
PID 4064 wrote to memory of 3328	4064	d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe	83
PID 4064 wrote to memory of 4560	4064	d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe	95
PID 4064 wrote to memory of 4560	4064	d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe	95
PID 4064 wrote to memory of 4560	4064	d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe	95
PID 4064 wrote to memory of 4560	4064	d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe	95
PID 4064 wrote to memory of 4560	4064	d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe	95
PID 4560 wrote to memory of 1604	4560	d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe	96
PID 4560 wrote to memory of 1604	4560	d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe	96
PID 4560 wrote to memory of 1604	4560	d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe	96
PID 1604 wrote to memory of 1180	1604	explorer.exe	99
PID 1604 wrote to memory of 1180	1604	explorer.exe	99
PID 1604 wrote to memory of 1180	1604	explorer.exe	99
PID 1604 wrote to memory of 1180	1604	explorer.exe	99
PID 1604 wrote to memory of 1180	1604	explorer.exe	99
PID 1180 wrote to memory of 3540	1180	explorer.exe	100
PID 1180 wrote to memory of 3540	1180	explorer.exe	100
PID 1180 wrote to memory of 3540	1180	explorer.exe	100
PID 1180 wrote to memory of 3492	1180	explorer.exe	101
PID 1180 wrote to memory of 3492	1180	explorer.exe	101
PID 1180 wrote to memory of 3492	1180	explorer.exe	101
PID 1180 wrote to memory of 4652	1180	explorer.exe	102
PID 1180 wrote to memory of 4652	1180	explorer.exe	102
PID 1180 wrote to memory of 4652	1180	explorer.exe	102
PID 1180 wrote to memory of 3204	1180	explorer.exe	103
PID 1180 wrote to memory of 3204	1180	explorer.exe	103
PID 1180 wrote to memory of 3204	1180	explorer.exe	103
PID 1180 wrote to memory of 2304	1180	explorer.exe	104
PID 1180 wrote to memory of 2304	1180	explorer.exe	104
PID 1180 wrote to memory of 2304	1180	explorer.exe	104
PID 1180 wrote to memory of 540	1180	explorer.exe	105
PID 1180 wrote to memory of 540	1180	explorer.exe	105
PID 1180 wrote to memory of 540	1180	explorer.exe	105
PID 1180 wrote to memory of 864	1180	explorer.exe	106
PID 1180 wrote to memory of 864	1180	explorer.exe	106
PID 1180 wrote to memory of 864	1180	explorer.exe	106
PID 1180 wrote to memory of 5080	1180	explorer.exe	107
PID 1180 wrote to memory of 5080	1180	explorer.exe	107
PID 1180 wrote to memory of 5080	1180	explorer.exe	107
PID 1180 wrote to memory of 3844	1180	explorer.exe	108
PID 1180 wrote to memory of 3844	1180	explorer.exe	108
PID 1180 wrote to memory of 3844	1180	explorer.exe	108
PID 1180 wrote to memory of 5008	1180	explorer.exe	109
PID 1180 wrote to memory of 5008	1180	explorer.exe	109
PID 1180 wrote to memory of 5008	1180	explorer.exe	109
PID 1180 wrote to memory of 3404	1180	explorer.exe	110
PID 1180 wrote to memory of 3404	1180	explorer.exe	110
PID 1180 wrote to memory of 3404	1180	explorer.exe	110
PID 1180 wrote to memory of 3620	1180	explorer.exe	111
PID 1180 wrote to memory of 3620	1180	explorer.exe	111
PID 1180 wrote to memory of 3620	1180	explorer.exe	111
PID 1180 wrote to memory of 1220	1180	explorer.exe	112
PID 1180 wrote to memory of 1220	1180	explorer.exe	112
PID 1180 wrote to memory of 1220	1180	explorer.exe	112
PID 1180 wrote to memory of 4552	1180	explorer.exe	113
PID 1180 wrote to memory of 4552	1180	explorer.exe	113
PID 1180 wrote to memory of 4552	1180	explorer.exe	113
PID 1180 wrote to memory of 3684	1180	explorer.exe	114
PID 1180 wrote to memory of 3684	1180	explorer.exe	114
PID 1180 wrote to memory of 3684	1180	explorer.exe	114
PID 1180 wrote to memory of 3628	1180	explorer.exe	115
PID 1180 wrote to memory of 3628	1180	explorer.exe	115
PID 1180 wrote to memory of 3628	1180	explorer.exe	115
PID 1180 wrote to memory of 3264	1180	explorer.exe	116

C:\Users\Admin\AppData\Local\Temp\d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3328
- C:\Users\Admin\AppData\Local\Temp\d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d6d362ab7c508c5c660037b918b579e0_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4560
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4664
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3688
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2232
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4652
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3204
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:864
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4592
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4112
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3844
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3404
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3620
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:800
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3264
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4976
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3988
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4600
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1088
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5104
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1672
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:372
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2412
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3292
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5028
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3760
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3624
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4596
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2532
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4236
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4608
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4092
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5096
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2552
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2044
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3240
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4740
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3612
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5200
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3140
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1452
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2932
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3800
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6088
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3716
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5924
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:232
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2156
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
fbef8524d05b8243f11d7ef526fbe66a

SHA1
96c7465c8802e16c5c4b53856b11b4a6cf058a11

SHA256
e8aa621a6082f22815dbc8b8169f59f866dd05e2549d83c075155fbf61dfb82f

SHA512
cddbf81f2b915d4d9f094ea819e4e38ed24d5c55d373a623a533637901559e16b1e279301b0e6fd3c3c7ad039dd48ebfa0bd317ea35274e2ebc710ff6f8cc7c2

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
7a1c9e9a4338dd8eaa5bf8dbb1957e39

SHA1
895926c516262a1a4187fcaba59fd43cd24b9fa4

SHA256
1dc32bd6a2cd36a4850174ae16e1fffab7421a2fe70b8cd7591cb434aacdf36b

SHA512
cf8b6641304dd2256d4a263752aebbc7b2bd780b708cacd24e19e54466c336f7cae7ba931615b9f426723c880854330b1aecfaaab3be2d4e1c3bc86605020b36

Download Submit
memory/464-5504-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/540-1310-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/656-2464-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/656-2462-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/668-2471-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/672-2707-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/748-3039-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/864-1396-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/892-2598-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1028-3059-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1064-2938-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1076-2475-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1076-2476-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/1088-3155-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1088-3339-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1180-110-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1180-4656-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1180-864-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1220-1819-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1452-6157-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1452-5997-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1548-5497-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1580-3068-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1604-104-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1604-108-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1632-3273-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1632-3277-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2044-5486-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2044-5624-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2232-3924-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2276-2819-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2276-2823-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2304-1309-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2552-5182-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2552-5110-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2616-2945-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2892-2485-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2936-6285-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2936-6289-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2992-2588-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3012-4271-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3044-2448-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3204-1178-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3216-3099-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3260-2359-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3264-2066-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3292-3356-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3292-3487-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3360-5581-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3404-1650-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3492-2465-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3492-1036-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3504-2873-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3540-2453-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3540-920-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3620-1718-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3628-1999-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3632-5043-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3668-3178-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3684-1922-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3844-1563-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3964-2720-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3964-2716-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3988-2200-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4004-5388-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4064-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4064-49-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4064-42-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4064-0-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4104-2810-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4104-2808-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4200-3028-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4236-4193-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4364-2697-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4436-6198-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4552-1921-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4560-44-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4560-45-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4560-93-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4592-2686-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4592-2920-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4596-3807-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4600-2460-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4616-3366-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4616-3362-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4652-2473-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4652-1112-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4660-3265-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4664-2668-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4688-2449-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4776-2498-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4776-2496-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4800-2831-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4968-3078-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4976-2199-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5008-1649-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5032-3047-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5068-3090-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5080-1462-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5092-2282-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5200-5881-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5200-5735-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5516-5796-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5696-5904-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5848-5900-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5924-6417-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6088-6185-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6088-6326-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download