pony | 53b182d0b068bb1551c243531dfb2fc06b1b62907c754c6dc9060c745ac2494c

Analysis

max time kernel
136s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2024 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe
Size

2.2MB
MD5

dd159eec5fede996f1773e9d29a91911
SHA1

fbb1dbea20d94144212def55cea3e8ecfc0677ab
SHA256

53b182d0b068bb1551c243531dfb2fc06b1b62907c754c6dc9060c745ac2494c
SHA512

8c86a58722f2234eba634a82b2e69dca3717a3e16ba160845259b3e7eb52be71c024b6512f45f7d6a255106f6d5077f5b8149e2564fd82251bcc51817073e57d
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZv:0UzeyQMS4DqodCnoe+iitjWwwL

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
536	explorer.exe
5008	explorer.exe
8	spoolsv.exe
5036	spoolsv.exe
4396	spoolsv.exe
4868	spoolsv.exe
536	spoolsv.exe
1120	spoolsv.exe
1040	spoolsv.exe
4800	spoolsv.exe
4484	spoolsv.exe
436	spoolsv.exe
596	spoolsv.exe
936	spoolsv.exe
1448	spoolsv.exe
3224	spoolsv.exe
404	spoolsv.exe
3776	spoolsv.exe
4632	spoolsv.exe
4260	spoolsv.exe
4412	spoolsv.exe
2016	spoolsv.exe
1408	spoolsv.exe
3952	spoolsv.exe
2552	spoolsv.exe
3852	spoolsv.exe
216	spoolsv.exe
4488	spoolsv.exe
2020	explorer.exe
5016	spoolsv.exe
3588	spoolsv.exe
1952	spoolsv.exe
2836	spoolsv.exe
1856	spoolsv.exe
964	explorer.exe
4824	spoolsv.exe
4740	spoolsv.exe
1552	spoolsv.exe
1508	spoolsv.exe
380	explorer.exe
2616	spoolsv.exe
948	spoolsv.exe
4544	spoolsv.exe
828	spoolsv.exe
1004	explorer.exe
2160	spoolsv.exe
1820	spoolsv.exe
3676	spoolsv.exe
1728	spoolsv.exe
880	explorer.exe
3496	spoolsv.exe
4568	spoolsv.exe
2704	spoolsv.exe
1332	spoolsv.exe
1060	explorer.exe
2564	spoolsv.exe
412	spoolsv.exe
3844	spoolsv.exe
4160	spoolsv.exe
1712	spoolsv.exe
4620	explorer.exe
2984	spoolsv.exe
1288	spoolsv.exe
3656	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 42 IoCs

description	pid	Process	procid_target
PID 5096 set thread context of 1236	5096	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe	96
PID 536 set thread context of 5008	536	explorer.exe	100
PID 8 set thread context of 4488	8	spoolsv.exe	126
PID 5036 set thread context of 3588	5036	spoolsv.exe	129
PID 4396 set thread context of 1952	4396	spoolsv.exe	130
PID 4868 set thread context of 1856	4868	spoolsv.exe	132
PID 536 set thread context of 4824	536	spoolsv.exe	134
PID 1120 set thread context of 4740	1120	spoolsv.exe	135
PID 1040 set thread context of 1508	1040	spoolsv.exe	137
PID 4800 set thread context of 2616	4800	spoolsv.exe	139
PID 4484 set thread context of 948	4484	spoolsv.exe	140
PID 436 set thread context of 828	436	spoolsv.exe	142
PID 596 set thread context of 2160	596	spoolsv.exe	144
PID 936 set thread context of 3676	936	spoolsv.exe	146
PID 1448 set thread context of 1728	1448	spoolsv.exe	147
PID 3224 set thread context of 3496	3224	spoolsv.exe	149
PID 404 set thread context of 2704	404	spoolsv.exe	151
PID 3776 set thread context of 1332	3776	spoolsv.exe	152
PID 4632 set thread context of 2564	4632	spoolsv.exe	154
PID 4260 set thread context of 412	4260	spoolsv.exe	155
PID 4412 set thread context of 4160	4412	spoolsv.exe	157
PID 2016 set thread context of 1712	2016	spoolsv.exe	158
PID 1408 set thread context of 1288	1408	spoolsv.exe	161
PID 3952 set thread context of 3656	3952	spoolsv.exe	162
PID 2552 set thread context of 3880	2552	spoolsv.exe	164
PID 3852 set thread context of 1068	3852	spoolsv.exe	166
PID 216 set thread context of 3180	216	spoolsv.exe	168
PID 2020 set thread context of 2740	2020	explorer.exe	172
PID 5016 set thread context of 2896	5016	spoolsv.exe	173
PID 2836 set thread context of 840	2836	spoolsv.exe	177
PID 964 set thread context of 3496	964	explorer.exe	179
PID 1552 set thread context of 4384	1552	spoolsv.exe	181
PID 380 set thread context of 1860	380	explorer.exe	183
PID 4544 set thread context of 5116	4544	spoolsv.exe	186
PID 1004 set thread context of 5084	1004	explorer.exe	189
PID 1820 set thread context of 3352	1820	spoolsv.exe	190
PID 880 set thread context of 5020	880	explorer.exe	193
PID 4568 set thread context of 1384	4568	spoolsv.exe	195
PID 1060 set thread context of 2692	1060	explorer.exe	198
PID 3844 set thread context of 208	3844	spoolsv.exe	199
PID 2984 set thread context of 2156	2984	spoolsv.exe	203
PID 4620 set thread context of 3400	4620	explorer.exe	205

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1236	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe
1236	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1236	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe
1236	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
4488	spoolsv.exe
4488	spoolsv.exe
3588	spoolsv.exe
3588	spoolsv.exe
1952	spoolsv.exe
1952	spoolsv.exe
1856	spoolsv.exe
1856	spoolsv.exe
4824	spoolsv.exe
4824	spoolsv.exe
4740	spoolsv.exe
4740	spoolsv.exe
1508	spoolsv.exe
1508	spoolsv.exe
2616	spoolsv.exe
2616	spoolsv.exe
948	spoolsv.exe
948	spoolsv.exe
828	spoolsv.exe
828	spoolsv.exe
2160	spoolsv.exe
2160	spoolsv.exe
3676	spoolsv.exe
3676	spoolsv.exe
1728	spoolsv.exe
1728	spoolsv.exe
3496	spoolsv.exe
3496	spoolsv.exe
2704	spoolsv.exe
2704	spoolsv.exe
1332	spoolsv.exe
1332	spoolsv.exe
2564	spoolsv.exe
2564	spoolsv.exe
412	spoolsv.exe
412	spoolsv.exe
4160	spoolsv.exe
4160	spoolsv.exe
1712	spoolsv.exe
1712	spoolsv.exe
1288	spoolsv.exe
1288	spoolsv.exe
3656	spoolsv.exe
3656	spoolsv.exe
3880	spoolsv.exe
3880	spoolsv.exe
1068	spoolsv.exe
1068	spoolsv.exe
3180	spoolsv.exe
3180	spoolsv.exe
2740	explorer.exe
2740	explorer.exe
2896	spoolsv.exe
2896	spoolsv.exe
840	spoolsv.exe
840	spoolsv.exe
3496	explorer.exe
3496	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 1760	5096	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe	84
PID 5096 wrote to memory of 1760	5096	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe	84
PID 5096 wrote to memory of 1236	5096	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe	96
PID 5096 wrote to memory of 1236	5096	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe	96
PID 5096 wrote to memory of 1236	5096	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe	96
PID 5096 wrote to memory of 1236	5096	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe	96
PID 5096 wrote to memory of 1236	5096	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe	96
PID 1236 wrote to memory of 536	1236	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe	97
PID 1236 wrote to memory of 536	1236	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe	97
PID 1236 wrote to memory of 536	1236	dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe	97
PID 536 wrote to memory of 5008	536	explorer.exe	100
PID 536 wrote to memory of 5008	536	explorer.exe	100
PID 536 wrote to memory of 5008	536	explorer.exe	100
PID 536 wrote to memory of 5008	536	explorer.exe	100
PID 536 wrote to memory of 5008	536	explorer.exe	100
PID 5008 wrote to memory of 8	5008	explorer.exe	101
PID 5008 wrote to memory of 8	5008	explorer.exe	101
PID 5008 wrote to memory of 8	5008	explorer.exe	101
PID 5008 wrote to memory of 5036	5008	explorer.exe	102
PID 5008 wrote to memory of 5036	5008	explorer.exe	102
PID 5008 wrote to memory of 5036	5008	explorer.exe	102
PID 5008 wrote to memory of 4396	5008	explorer.exe	103
PID 5008 wrote to memory of 4396	5008	explorer.exe	103
PID 5008 wrote to memory of 4396	5008	explorer.exe	103
PID 5008 wrote to memory of 4868	5008	explorer.exe	104
PID 5008 wrote to memory of 4868	5008	explorer.exe	104
PID 5008 wrote to memory of 4868	5008	explorer.exe	104
PID 5008 wrote to memory of 536	5008	explorer.exe	105
PID 5008 wrote to memory of 536	5008	explorer.exe	105
PID 5008 wrote to memory of 536	5008	explorer.exe	105
PID 5008 wrote to memory of 1120	5008	explorer.exe	106
PID 5008 wrote to memory of 1120	5008	explorer.exe	106
PID 5008 wrote to memory of 1120	5008	explorer.exe	106
PID 5008 wrote to memory of 1040	5008	explorer.exe	107
PID 5008 wrote to memory of 1040	5008	explorer.exe	107
PID 5008 wrote to memory of 1040	5008	explorer.exe	107
PID 5008 wrote to memory of 4800	5008	explorer.exe	108
PID 5008 wrote to memory of 4800	5008	explorer.exe	108
PID 5008 wrote to memory of 4800	5008	explorer.exe	108
PID 5008 wrote to memory of 4484	5008	explorer.exe	109
PID 5008 wrote to memory of 4484	5008	explorer.exe	109
PID 5008 wrote to memory of 4484	5008	explorer.exe	109
PID 5008 wrote to memory of 436	5008	explorer.exe	110
PID 5008 wrote to memory of 436	5008	explorer.exe	110
PID 5008 wrote to memory of 436	5008	explorer.exe	110
PID 5008 wrote to memory of 596	5008	explorer.exe	111
PID 5008 wrote to memory of 596	5008	explorer.exe	111
PID 5008 wrote to memory of 596	5008	explorer.exe	111
PID 5008 wrote to memory of 936	5008	explorer.exe	112
PID 5008 wrote to memory of 936	5008	explorer.exe	112
PID 5008 wrote to memory of 936	5008	explorer.exe	112
PID 5008 wrote to memory of 1448	5008	explorer.exe	113
PID 5008 wrote to memory of 1448	5008	explorer.exe	113
PID 5008 wrote to memory of 1448	5008	explorer.exe	113
PID 5008 wrote to memory of 3224	5008	explorer.exe	114
PID 5008 wrote to memory of 3224	5008	explorer.exe	114
PID 5008 wrote to memory of 3224	5008	explorer.exe	114
PID 5008 wrote to memory of 404	5008	explorer.exe	115
PID 5008 wrote to memory of 404	5008	explorer.exe	115
PID 5008 wrote to memory of 404	5008	explorer.exe	115
PID 5008 wrote to memory of 3776	5008	explorer.exe	116
PID 5008 wrote to memory of 3776	5008	explorer.exe	116
PID 5008 wrote to memory of 3776	5008	explorer.exe	116
PID 5008 wrote to memory of 4632	5008	explorer.exe	117

C:\Users\Admin\AppData\Local\Temp\dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1760
- C:\Users\Admin\AppData\Local\Temp\dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\dd159eec5fede996f1773e9d29a91911_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1236
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:536
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:8
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4488
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2020
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1856
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:964
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:536
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1508
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:380
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4800
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:828
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1004
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1728
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:880
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3224
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:404
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3776
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1332
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1060
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4632
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4412
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1712
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4620
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1408
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3880
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4416
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1232
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3852
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3180
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2316
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2896
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2736
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:840
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1116
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4384
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3104
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3144
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5116
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1820
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3352
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1384
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3844
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:208
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2984
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2156
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3464
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:324
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:660
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3932
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2948
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1684
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3004
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2644
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1232
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
a66917bf8b8902c8884960ac16ef6550

SHA1
36b9ec5f505254d03815c34578cc58ee91e7a37c

SHA256
405bd1935e727aca103390433edf2184ed670f10d90f82c84fae869baacc05d2

SHA512
69cc79267c72a053bc9dbfe90fd1cc2a60eb92ad9472c05ed867c983b288617730cf4a6a73e3f64aae2152560e76a54c9679ea6d4ec7545e68a46dda32a34a8d

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
a05b3b882c10a8d25108590e29cb20b6

SHA1
3934a19637ea2f5e9709bcf015b3cfb60c0cbe59

SHA256
f70228711904368ae7defa839a4bd0b74cadb61b507e38848fae2123243d45ea

SHA512
978a263ee51a3b09d134a89bae5fcfdbfecf94ebc4649339c0c582f1ebb5bef2731619f7fc5ab515a445f94d7bb394e48d0c42c1ede2c09c0fc592e8cb92984c

Download Submit
memory/8-1705-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/8-629-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/208-4489-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/404-1625-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/412-2633-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/436-1355-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/536-90-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/536-96-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/536-959-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/596-1377-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/828-2447-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/828-2296-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/832-4666-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/840-3599-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/936-1449-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/948-2158-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1040-1155-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1120-1089-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1232-4637-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1236-35-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1236-34-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1236-77-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/1236-79-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1288-2860-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1332-2613-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1384-4329-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1448-1496-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1508-2127-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1508-2268-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1684-4947-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1712-2788-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1712-2931-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1728-2464-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1728-2591-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1856-1945-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1856-2065-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1860-3629-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1952-1785-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1952-1788-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2016-1939-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2156-4501-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2160-2309-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2160-2305-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2564-2624-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2616-2136-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2644-5103-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2692-4259-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2704-2550-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2704-2553-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2740-3337-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2780-4657-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2896-3340-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2896-3442-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2948-4798-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3144-5168-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3180-3246-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3224-1563-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3352-4111-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3352-4008-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3364-4966-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3400-4511-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3464-4627-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3464-4768-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3476-4954-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3496-2474-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3496-3542-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3496-2477-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3588-1776-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3656-2871-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3676-2390-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3676-2393-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3776-1696-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3880-3120-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4160-2721-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4160-2726-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4256-4808-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4260-1774-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4364-5178-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4364-5183-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4384-3619-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4384-3742-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4396-832-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4396-1789-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4412-1783-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4484-1284-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4488-1704-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4488-1857-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4632-1702-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4740-1967-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4800-1228-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4824-1955-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4868-898-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4868-1947-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5008-567-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5008-95-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5020-4069-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5036-766-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5036-1777-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5084-3988-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5096-31-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5096-32-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/5096-0-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/5096-37-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5116-3857-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5116-3970-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download