pony | 32033f1ed0f756887fb90c58d33baa36025c7c6fc4af6ac695a093b7283f8e1a

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-09-2024 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe
Size

2.2MB
MD5

d8af47bbe18074e5fcfadd2ea319745c
SHA1

91e51e5a4f20b36702afc4f4686b9631bcbfb266
SHA256

32033f1ed0f756887fb90c58d33baa36025c7c6fc4af6ac695a093b7283f8e1a
SHA512

5d7c058cbe8be8487b68ee9d79738ae3975a42d3ea80131b9739be61b2abfef28fa1eadde39ad3d26c6f4dad8d536597ba683d5c49ba6a2f839c6896704288e3
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZU:0UzeyQMS4DqodCnoe+iitjWwwQ

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe	d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe	d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
3216	explorer.exe
3664	explorer.exe
3968	spoolsv.exe
2768	spoolsv.exe
3688	spoolsv.exe
5004	spoolsv.exe
1620	spoolsv.exe
4684	spoolsv.exe
216	spoolsv.exe
4248	spoolsv.exe
1220	spoolsv.exe
3052	spoolsv.exe
4112	spoolsv.exe
4460	spoolsv.exe
2788	spoolsv.exe
2512	spoolsv.exe
1588	spoolsv.exe
2676	spoolsv.exe
1628	spoolsv.exe
2448	spoolsv.exe
4772	spoolsv.exe
2856	spoolsv.exe
5088	spoolsv.exe
5036	spoolsv.exe
2396	spoolsv.exe
1232	spoolsv.exe
2672	spoolsv.exe
3608	spoolsv.exe
4620	spoolsv.exe
4260	spoolsv.exe
3652	spoolsv.exe
3660	spoolsv.exe
2408	spoolsv.exe
3572	spoolsv.exe
2648	spoolsv.exe
3740	spoolsv.exe
2700	spoolsv.exe
1948	spoolsv.exe
2436	spoolsv.exe
3800	explorer.exe
4900	spoolsv.exe
3840	spoolsv.exe
2916	spoolsv.exe
4752	spoolsv.exe
1044	spoolsv.exe
4384	spoolsv.exe
3892	spoolsv.exe
2224	spoolsv.exe
2416	spoolsv.exe
4892	explorer.exe
4236	spoolsv.exe
3416	spoolsv.exe
2920	spoolsv.exe
2556	spoolsv.exe
4904	spoolsv.exe
2392	spoolsv.exe
1348	spoolsv.exe
568	spoolsv.exe
3508	spoolsv.exe
4292	spoolsv.exe
5096	explorer.exe
900	spoolsv.exe
4520	spoolsv.exe
4876	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 63 IoCs

description	pid	Process	procid_target
PID 3416 set thread context of 3252	3416	d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe	93
PID 3216 set thread context of 3664	3216	explorer.exe	99
PID 3968 set thread context of 2436	3968	spoolsv.exe	137
PID 2768 set thread context of 4900	2768	spoolsv.exe	139
PID 3688 set thread context of 3840	3688	spoolsv.exe	140
PID 5004 set thread context of 4752	5004	spoolsv.exe	142
PID 1620 set thread context of 1044	1620	spoolsv.exe	143
PID 4684 set thread context of 4384	4684	spoolsv.exe	144
PID 216 set thread context of 3892	216	spoolsv.exe	145
PID 4248 set thread context of 2224	4248	spoolsv.exe	146
PID 1220 set thread context of 2416	1220	spoolsv.exe	147
PID 3052 set thread context of 3416	3052	spoolsv.exe	150
PID 4112 set thread context of 2920	4112	spoolsv.exe	151
PID 4460 set thread context of 2556	4460	spoolsv.exe	152
PID 2788 set thread context of 4904	2788	spoolsv.exe	153
PID 2512 set thread context of 2392	2512	spoolsv.exe	154
PID 1588 set thread context of 1348	1588	spoolsv.exe	155
PID 2676 set thread context of 568	2676	spoolsv.exe	156
PID 1628 set thread context of 4292	1628	spoolsv.exe	158
PID 2448 set thread context of 900	2448	spoolsv.exe	160
PID 4772 set thread context of 4520	4772	spoolsv.exe	161
PID 2856 set thread context of 4876	2856	spoolsv.exe	162
PID 5088 set thread context of 2132	5088	spoolsv.exe	163
PID 5036 set thread context of 4616	5036	spoolsv.exe	164
PID 2396 set thread context of 1116	2396	spoolsv.exe	166
PID 1232 set thread context of 3276	1232	spoolsv.exe	168
PID 2672 set thread context of 2800	2672	spoolsv.exe	169
PID 3608 set thread context of 2116	3608	spoolsv.exe	170
PID 4620 set thread context of 208	4620	spoolsv.exe	171
PID 4260 set thread context of 2792	4260	spoolsv.exe	172
PID 3652 set thread context of 4908	3652	spoolsv.exe	174
PID 3660 set thread context of 4420	3660	spoolsv.exe	175
PID 2408 set thread context of 4524	2408	spoolsv.exe	177
PID 3572 set thread context of 4748	3572	spoolsv.exe	178
PID 2648 set thread context of 4196	2648	spoolsv.exe	179
PID 3740 set thread context of 2404	3740	spoolsv.exe	180
PID 2700 set thread context of 3468	2700	spoolsv.exe	182
PID 1948 set thread context of 3324	1948	spoolsv.exe	187
PID 3800 set thread context of 4396	3800	explorer.exe	192
PID 2916 set thread context of 2500	2916	spoolsv.exe	193
PID 4892 set thread context of 4920	4892	explorer.exe	198
PID 4236 set thread context of 1484	4236	spoolsv.exe	199
PID 5096 set thread context of 3920	5096	explorer.exe	205
PID 3508 set thread context of 3452	3508	spoolsv.exe	206
PID 1696 set thread context of 452	1696	spoolsv.exe	213
PID 4988 set thread context of 1412	4988	explorer.exe	215
PID 4228 set thread context of 552	4228	spoolsv.exe	220
PID 1624 set thread context of 5148	1624	explorer.exe	222
PID 4532 set thread context of 5224	4532	spoolsv.exe	223
PID 4456 set thread context of 5288	4456	explorer.exe	224
PID 1564 set thread context of 5360	1564	spoolsv.exe	225
PID 2836 set thread context of 5508	2836	spoolsv.exe	226
PID 2832 set thread context of 5572	2832	spoolsv.exe	227
PID 796 set thread context of 5632	796	explorer.exe	228
PID 2444 set thread context of 5692	2444	spoolsv.exe	229
PID 3932 set thread context of 5276	3932	spoolsv.exe	231
PID 1064 set thread context of 5808	1064	spoolsv.exe	234
PID 2864 set thread context of 6028	2864	explorer.exe	236
PID 4944 set thread context of 5152	4944	spoolsv.exe	238
PID 3344 set thread context of 2284	3344	spoolsv.exe	239
PID 3164 set thread context of 1428	3164	spoolsv.exe	241
PID 2024 set thread context of 4640	2024	explorer.exe	243
PID 636 set thread context of 5660	636	spoolsv.exe	244

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3252	d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe
3252	d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3664	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3252	d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe
3252	d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
3664	explorer.exe
2436	spoolsv.exe
2436	spoolsv.exe
4900	spoolsv.exe
4900	spoolsv.exe
3840	spoolsv.exe
3840	spoolsv.exe
4752	spoolsv.exe
4752	spoolsv.exe
1044	spoolsv.exe
1044	spoolsv.exe
4384	spoolsv.exe
4384	spoolsv.exe
3892	spoolsv.exe
3892	spoolsv.exe
2224	spoolsv.exe
2224	spoolsv.exe
2416	spoolsv.exe
2416	spoolsv.exe
3416	spoolsv.exe
3416	spoolsv.exe
2920	spoolsv.exe
2920	spoolsv.exe
2556	spoolsv.exe
2556	spoolsv.exe
4904	spoolsv.exe
4904	spoolsv.exe
2392	spoolsv.exe
2392	spoolsv.exe
1348	spoolsv.exe
1348	spoolsv.exe
568	spoolsv.exe
568	spoolsv.exe
4292	spoolsv.exe
4292	spoolsv.exe
900	spoolsv.exe
900	spoolsv.exe
4520	spoolsv.exe
4520	spoolsv.exe
4876	spoolsv.exe
4876	spoolsv.exe
2132	spoolsv.exe
2132	spoolsv.exe
4616	spoolsv.exe
4616	spoolsv.exe
1116	spoolsv.exe
1116	spoolsv.exe
3276	spoolsv.exe
3276	spoolsv.exe
2800	spoolsv.exe
2800	spoolsv.exe
2116	spoolsv.exe
2116	spoolsv.exe
208	spoolsv.exe
208	spoolsv.exe
2792	spoolsv.exe
2792	spoolsv.exe
4908	spoolsv.exe
4908	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 4352	3416	d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe	84
PID 3416 wrote to memory of 4352	3416	d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe	84
PID 3416 wrote to memory of 3252	3416	d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe	93
PID 3416 wrote to memory of 3252	3416	d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe	93
PID 3416 wrote to memory of 3252	3416	d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe	93
PID 3416 wrote to memory of 3252	3416	d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe	93
PID 3416 wrote to memory of 3252	3416	d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe	93
PID 3252 wrote to memory of 3216	3252	d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe	94
PID 3252 wrote to memory of 3216	3252	d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe	94
PID 3252 wrote to memory of 3216	3252	d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe	94
PID 3216 wrote to memory of 3664	3216	explorer.exe	99
PID 3216 wrote to memory of 3664	3216	explorer.exe	99
PID 3216 wrote to memory of 3664	3216	explorer.exe	99
PID 3216 wrote to memory of 3664	3216	explorer.exe	99
PID 3216 wrote to memory of 3664	3216	explorer.exe	99
PID 3664 wrote to memory of 3968	3664	explorer.exe	100
PID 3664 wrote to memory of 3968	3664	explorer.exe	100
PID 3664 wrote to memory of 3968	3664	explorer.exe	100
PID 3664 wrote to memory of 2768	3664	explorer.exe	101
PID 3664 wrote to memory of 2768	3664	explorer.exe	101
PID 3664 wrote to memory of 2768	3664	explorer.exe	101
PID 3664 wrote to memory of 3688	3664	explorer.exe	102
PID 3664 wrote to memory of 3688	3664	explorer.exe	102
PID 3664 wrote to memory of 3688	3664	explorer.exe	102
PID 3664 wrote to memory of 5004	3664	explorer.exe	103
PID 3664 wrote to memory of 5004	3664	explorer.exe	103
PID 3664 wrote to memory of 5004	3664	explorer.exe	103
PID 3664 wrote to memory of 1620	3664	explorer.exe	104
PID 3664 wrote to memory of 1620	3664	explorer.exe	104
PID 3664 wrote to memory of 1620	3664	explorer.exe	104
PID 3664 wrote to memory of 4684	3664	explorer.exe	105
PID 3664 wrote to memory of 4684	3664	explorer.exe	105
PID 3664 wrote to memory of 4684	3664	explorer.exe	105
PID 3664 wrote to memory of 216	3664	explorer.exe	106
PID 3664 wrote to memory of 216	3664	explorer.exe	106
PID 3664 wrote to memory of 216	3664	explorer.exe	106
PID 3664 wrote to memory of 4248	3664	explorer.exe	107
PID 3664 wrote to memory of 4248	3664	explorer.exe	107
PID 3664 wrote to memory of 4248	3664	explorer.exe	107
PID 3664 wrote to memory of 1220	3664	explorer.exe	108
PID 3664 wrote to memory of 1220	3664	explorer.exe	108
PID 3664 wrote to memory of 1220	3664	explorer.exe	108
PID 3664 wrote to memory of 3052	3664	explorer.exe	109
PID 3664 wrote to memory of 3052	3664	explorer.exe	109
PID 3664 wrote to memory of 3052	3664	explorer.exe	109
PID 3664 wrote to memory of 4112	3664	explorer.exe	110
PID 3664 wrote to memory of 4112	3664	explorer.exe	110
PID 3664 wrote to memory of 4112	3664	explorer.exe	110
PID 3664 wrote to memory of 4460	3664	explorer.exe	111
PID 3664 wrote to memory of 4460	3664	explorer.exe	111
PID 3664 wrote to memory of 4460	3664	explorer.exe	111
PID 3664 wrote to memory of 2788	3664	explorer.exe	112
PID 3664 wrote to memory of 2788	3664	explorer.exe	112
PID 3664 wrote to memory of 2788	3664	explorer.exe	112
PID 3664 wrote to memory of 2512	3664	explorer.exe	113
PID 3664 wrote to memory of 2512	3664	explorer.exe	113
PID 3664 wrote to memory of 2512	3664	explorer.exe	113
PID 3664 wrote to memory of 1588	3664	explorer.exe	114
PID 3664 wrote to memory of 1588	3664	explorer.exe	114
PID 3664 wrote to memory of 1588	3664	explorer.exe	114
PID 3664 wrote to memory of 2676	3664	explorer.exe	115
PID 3664 wrote to memory of 2676	3664	explorer.exe	115
PID 3664 wrote to memory of 2676	3664	explorer.exe	115
PID 3664 wrote to memory of 1628	3664	explorer.exe	116

C:\Users\Admin\AppData\Local\Temp\d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4352
- C:\Users\Admin\AppData\Local\Temp\d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d8af47bbe18074e5fcfadd2ea319745c_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3252
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3968
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2436
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3800
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5004
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1620
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4248
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2416
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4892
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4460
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2788
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1588
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4292
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5096
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4772
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2856
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1116
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4988
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1232
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2672
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4620
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3652
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3660
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4420
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:1624
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2408
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2648
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3740
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2700
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3468
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4456
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1948
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3324
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:796
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2916
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2500
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2864
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:6028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4236
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1484
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2024
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3508
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3452
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1696
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:452
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:552
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4532
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3932
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5276
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5808
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3344
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1428
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:636
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:6108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:6088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
bb0c60de01ef2c00757a3ff695de576c

SHA1
7ea4db2422bfc0b18919401f98190e93602eca26

SHA256
ef1617c6520eab4b80589a906a5c38412c38bfc0ef7e79b89b43d3904463f139

SHA512
9674c7f0f44ed8454cec3fd2ecf26020e3732a045a69b9b8f058e29b058c04e33de2bc99ffae4df03081eb11be90eab26967fce4b90d77144000761bcd18e369

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
2c5e927f180423a0bc55460fa29c706a

SHA1
a04e73d08da67a901e9a2692d2d667e17e998765

SHA256
9cf2592345a40e9c8724689f3c99062037f0a439cb5be646e0064c16aec30d98

SHA512
3c2138c2a14a0d673dbd72532d3f9c6e3d9a3930592cac69d2c762bde9103e30ed278c1cd8c4ce162d1950a7286c03180526edf41f88c4faf9dde104116e9645

Download Submit
memory/208-2989-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/216-1322-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/452-4759-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/552-5085-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/568-2727-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/900-2792-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1044-2394-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1116-2952-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1220-1514-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1232-2275-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1348-2645-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1412-4768-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1428-5630-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1484-4204-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1588-1848-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1620-1250-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1628-1916-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2116-2978-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2116-2982-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2132-2818-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2132-2823-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2284-5559-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2392-2635-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2396-2274-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2416-2703-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2416-2504-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2436-2281-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2436-2480-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2448-1994-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2500-3933-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2512-1766-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2556-2617-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2556-2612-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2672-2292-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2676-1915-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2768-2290-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2768-957-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2788-1765-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2800-2971-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2856-2077-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2920-2604-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2920-2602-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3052-1515-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3216-81-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3216-75-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3252-64-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3252-62-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/3252-35-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3252-34-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3324-3674-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3416-38-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3416-2584-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3416-31-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3416-32-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/3416-0-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/3452-4453-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3608-2297-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3664-80-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3664-795-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3664-4308-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3688-1063-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3688-2296-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3840-2304-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3892-2415-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3920-4390-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3968-891-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3968-2282-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4112-1581-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4196-3191-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4248-1393-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4292-2924-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4292-2782-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4384-2404-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4396-3820-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4420-3163-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4420-3289-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4460-1653-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4520-2801-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4524-3174-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4616-2832-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4640-5649-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4684-1251-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4748-3184-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4748-3181-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4752-2383-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4772-2076-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4876-2810-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4900-2293-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4904-2625-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4908-3102-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4920-4092-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5004-1144-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5036-2251-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5088-2134-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5148-5095-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5152-5549-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5152-5544-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5276-5429-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5288-5115-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5360-5124-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5508-5134-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5572-5145-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5632-5156-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5660-5644-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5692-5163-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5808-5457-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6028-5533-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download