pony | ce76c5998917c4859d06cc06f886b90452c88d8850ed916701cd4c350f821bd8

Analysis

max time kernel
139s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2024 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe
Size

2.2MB
MD5

dc56fbfb547dcf8bcaac531e564609ae
SHA1

730b82c8268045b2714965f52056aadc2fcdfb9f
SHA256

ce76c5998917c4859d06cc06f886b90452c88d8850ed916701cd4c350f821bd8
SHA512

18bc94ce4a08f5dd4e7b05c66bf7b1eec61b87fe9f039922f19232b3ab96abce38859a5f006459349249ce6727aec6dccd6f0cd4b90f9cb462f4d9af2e94af36
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZG:0UzeyQMS4DqodCnoe+iitjWwwK

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe	dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe	dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
4860	explorer.exe
2104	explorer.exe
4584	spoolsv.exe
1180	spoolsv.exe
1588	spoolsv.exe
1940	spoolsv.exe
4832	spoolsv.exe
464	spoolsv.exe
4812	spoolsv.exe
8	spoolsv.exe
3892	spoolsv.exe
2444	spoolsv.exe
1908	spoolsv.exe
4352	spoolsv.exe
436	spoolsv.exe
4492	spoolsv.exe
3548	spoolsv.exe
3020	spoolsv.exe
2544	spoolsv.exe
3488	spoolsv.exe
4112	spoolsv.exe
3228	spoolsv.exe
4164	spoolsv.exe
1176	spoolsv.exe
4256	spoolsv.exe
1676	spoolsv.exe
2660	spoolsv.exe
2888	spoolsv.exe
4888	spoolsv.exe
996	spoolsv.exe
2608	spoolsv.exe
4388	spoolsv.exe
264	explorer.exe
448	spoolsv.exe
3016	spoolsv.exe
1328	spoolsv.exe
1888	spoolsv.exe
3608	spoolsv.exe
3276	explorer.exe
2396	spoolsv.exe
2996	spoolsv.exe
3724	spoolsv.exe
1520	spoolsv.exe
860	explorer.exe
2276	spoolsv.exe
2804	spoolsv.exe
1572	spoolsv.exe
4380	spoolsv.exe
4772	explorer.exe
1444	spoolsv.exe
4752	spoolsv.exe
2652	spoolsv.exe
1000	spoolsv.exe
1576	spoolsv.exe
3928	explorer.exe
2612	spoolsv.exe
5020	spoolsv.exe
1812	spoolsv.exe
392	spoolsv.exe
412	spoolsv.exe
2492	explorer.exe
5068	spoolsv.exe
4828	spoolsv.exe
3720	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 45 IoCs

description	pid	Process	procid_target
PID 5000 set thread context of 856	5000	dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe	95
PID 4860 set thread context of 2104	4860	explorer.exe	98
PID 4584 set thread context of 4388	4584	spoolsv.exe	128
PID 1180 set thread context of 448	1180	spoolsv.exe	130
PID 1588 set thread context of 3016	1588	spoolsv.exe	131
PID 1940 set thread context of 1888	1940	spoolsv.exe	133
PID 4832 set thread context of 3608	4832	spoolsv.exe	134
PID 464 set thread context of 2396	464	spoolsv.exe	136
PID 4812 set thread context of 2996	4812	spoolsv.exe	137
PID 8 set thread context of 1520	8	spoolsv.exe	139
PID 3892 set thread context of 2276	3892	spoolsv.exe	141
PID 2444 set thread context of 1572	2444	spoolsv.exe	143
PID 1908 set thread context of 4380	1908	spoolsv.exe	144
PID 4352 set thread context of 1444	4352	spoolsv.exe	146
PID 436 set thread context of 4752	436	spoolsv.exe	147
PID 4492 set thread context of 1000	4492	spoolsv.exe	149
PID 3548 set thread context of 1576	3548	spoolsv.exe	150
PID 3020 set thread context of 2612	3020	spoolsv.exe	152
PID 2544 set thread context of 5020	2544	spoolsv.exe	153
PID 3488 set thread context of 392	3488	spoolsv.exe	155
PID 3228 set thread context of 5068	3228	spoolsv.exe	158
PID 4164 set thread context of 4828	4164	spoolsv.exe	159
PID 1176 set thread context of 2312	1176	spoolsv.exe	161
PID 4256 set thread context of 4048	4256	spoolsv.exe	162
PID 1676 set thread context of 3620	1676	spoolsv.exe	164
PID 2660 set thread context of 2364	2660	spoolsv.exe	165
PID 2888 set thread context of 5056	2888	spoolsv.exe	167
PID 4888 set thread context of 3024	4888	spoolsv.exe	168
PID 996 set thread context of 3460	996	spoolsv.exe	170
PID 2608 set thread context of 2776	2608	spoolsv.exe	173
PID 264 set thread context of 3240	264	explorer.exe	176
PID 1328 set thread context of 4632	1328	spoolsv.exe	179
PID 3276 set thread context of 1476	3276	explorer.exe	181
PID 3724 set thread context of 3948	3724	spoolsv.exe	183
PID 860 set thread context of 4996	860	explorer.exe	185
PID 2804 set thread context of 2224	2804	spoolsv.exe	188
PID 4772 set thread context of 3708	4772	explorer.exe	191
PID 2652 set thread context of 1828	2652	spoolsv.exe	194
PID 3928 set thread context of 2340	3928	explorer.exe	197
PID 1812 set thread context of 4260	1812	spoolsv.exe	200
PID 2492 set thread context of 1384	2492	explorer.exe	203
PID 3720 set thread context of 4364	3720	spoolsv.exe	205
PID 2792 set thread context of 4748	2792	explorer.exe	207
PID 5008 set thread context of 4404	5008	spoolsv.exe	209
PID 3416 set thread context of 260	3416	explorer.exe	210

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
856	dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe
856	dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2104	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
856	dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe
856	dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
2104	explorer.exe
4388	spoolsv.exe
4388	spoolsv.exe
448	spoolsv.exe
448	spoolsv.exe
3016	spoolsv.exe
3016	spoolsv.exe
1888	spoolsv.exe
1888	spoolsv.exe
3608	spoolsv.exe
3608	spoolsv.exe
2396	spoolsv.exe
2396	spoolsv.exe
2996	spoolsv.exe
2996	spoolsv.exe
1520	spoolsv.exe
1520	spoolsv.exe
2276	spoolsv.exe
2276	spoolsv.exe
1572	spoolsv.exe
1572	spoolsv.exe
4380	spoolsv.exe
4380	spoolsv.exe
1444	spoolsv.exe
1444	spoolsv.exe
4752	spoolsv.exe
4752	spoolsv.exe
1000	spoolsv.exe
1000	spoolsv.exe
1576	spoolsv.exe
1576	spoolsv.exe
2612	spoolsv.exe
2612	spoolsv.exe
5020	spoolsv.exe
5020	spoolsv.exe
392	spoolsv.exe
392	spoolsv.exe
412	spoolsv.exe
412	spoolsv.exe
5068	spoolsv.exe
5068	spoolsv.exe
4828	spoolsv.exe
4828	spoolsv.exe
2312	spoolsv.exe
2312	spoolsv.exe
4048	spoolsv.exe
4048	spoolsv.exe
3620	spoolsv.exe
3620	spoolsv.exe
2364	spoolsv.exe
2364	spoolsv.exe
5056	spoolsv.exe
5056	spoolsv.exe
3024	spoolsv.exe
3024	spoolsv.exe
3460	spoolsv.exe
3460	spoolsv.exe
2776	spoolsv.exe
2776	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 4140	5000	dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe	84
PID 5000 wrote to memory of 4140	5000	dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe	84
PID 5000 wrote to memory of 856	5000	dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe	95
PID 5000 wrote to memory of 856	5000	dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe	95
PID 5000 wrote to memory of 856	5000	dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe	95
PID 5000 wrote to memory of 856	5000	dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe	95
PID 5000 wrote to memory of 856	5000	dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe	95
PID 856 wrote to memory of 4860	856	dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe	96
PID 856 wrote to memory of 4860	856	dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe	96
PID 856 wrote to memory of 4860	856	dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe	96
PID 4860 wrote to memory of 2104	4860	explorer.exe	98
PID 4860 wrote to memory of 2104	4860	explorer.exe	98
PID 4860 wrote to memory of 2104	4860	explorer.exe	98
PID 4860 wrote to memory of 2104	4860	explorer.exe	98
PID 4860 wrote to memory of 2104	4860	explorer.exe	98
PID 2104 wrote to memory of 4584	2104	explorer.exe	99
PID 2104 wrote to memory of 4584	2104	explorer.exe	99
PID 2104 wrote to memory of 4584	2104	explorer.exe	99
PID 2104 wrote to memory of 1180	2104	explorer.exe	100
PID 2104 wrote to memory of 1180	2104	explorer.exe	100
PID 2104 wrote to memory of 1180	2104	explorer.exe	100
PID 2104 wrote to memory of 1588	2104	explorer.exe	101
PID 2104 wrote to memory of 1588	2104	explorer.exe	101
PID 2104 wrote to memory of 1588	2104	explorer.exe	101
PID 2104 wrote to memory of 1940	2104	explorer.exe	102
PID 2104 wrote to memory of 1940	2104	explorer.exe	102
PID 2104 wrote to memory of 1940	2104	explorer.exe	102
PID 2104 wrote to memory of 4832	2104	explorer.exe	103
PID 2104 wrote to memory of 4832	2104	explorer.exe	103
PID 2104 wrote to memory of 4832	2104	explorer.exe	103
PID 2104 wrote to memory of 464	2104	explorer.exe	104
PID 2104 wrote to memory of 464	2104	explorer.exe	104
PID 2104 wrote to memory of 464	2104	explorer.exe	104
PID 2104 wrote to memory of 4812	2104	explorer.exe	105
PID 2104 wrote to memory of 4812	2104	explorer.exe	105
PID 2104 wrote to memory of 4812	2104	explorer.exe	105
PID 2104 wrote to memory of 8	2104	explorer.exe	106
PID 2104 wrote to memory of 8	2104	explorer.exe	106
PID 2104 wrote to memory of 8	2104	explorer.exe	106
PID 2104 wrote to memory of 3892	2104	explorer.exe	107
PID 2104 wrote to memory of 3892	2104	explorer.exe	107
PID 2104 wrote to memory of 3892	2104	explorer.exe	107
PID 2104 wrote to memory of 2444	2104	explorer.exe	108
PID 2104 wrote to memory of 2444	2104	explorer.exe	108
PID 2104 wrote to memory of 2444	2104	explorer.exe	108
PID 2104 wrote to memory of 1908	2104	explorer.exe	109
PID 2104 wrote to memory of 1908	2104	explorer.exe	109
PID 2104 wrote to memory of 1908	2104	explorer.exe	109
PID 2104 wrote to memory of 4352	2104	explorer.exe	110
PID 2104 wrote to memory of 4352	2104	explorer.exe	110
PID 2104 wrote to memory of 4352	2104	explorer.exe	110
PID 2104 wrote to memory of 436	2104	explorer.exe	111
PID 2104 wrote to memory of 436	2104	explorer.exe	111
PID 2104 wrote to memory of 436	2104	explorer.exe	111
PID 2104 wrote to memory of 4492	2104	explorer.exe	112
PID 2104 wrote to memory of 4492	2104	explorer.exe	112
PID 2104 wrote to memory of 4492	2104	explorer.exe	112
PID 2104 wrote to memory of 3548	2104	explorer.exe	113
PID 2104 wrote to memory of 3548	2104	explorer.exe	113
PID 2104 wrote to memory of 3548	2104	explorer.exe	113
PID 2104 wrote to memory of 3020	2104	explorer.exe	114
PID 2104 wrote to memory of 3020	2104	explorer.exe	114
PID 2104 wrote to memory of 3020	2104	explorer.exe	114
PID 2104 wrote to memory of 2544	2104	explorer.exe	115

C:\Users\Admin\AppData\Local\Temp\dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4140
- C:\Users\Admin\AppData\Local\Temp\dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\dc56fbfb547dcf8bcaac531e564609ae_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:856
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4388
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:264
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3240
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1180
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1588
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1940
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3608
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3276
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4812
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:8
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1520
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:860
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3892
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1908
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4380
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4772
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4352
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3548
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1576
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3928
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3488
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:412
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2492
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1176
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4048
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2792
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2660
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2888
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4888
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3024
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3416
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:996
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2776
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4332
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4632
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4588
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3724
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3948
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1924
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2224
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2652
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1828
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1812
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4260
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3720
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4364
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3916
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3448
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3152
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4320
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3536
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:760
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4816
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4760
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
97d30e38dd981b72addf5fc21381cad1

SHA1
d78c6e634c2f206e53070670761a2f1c4ba34139

SHA256
603df11fecd17d9a43d2198e15e402e1f514f8eacd1349fde32473636c990629

SHA512
90a345ac25865497a2d0db9301da138922e561c38c30d7b7337ff047272220eff176bc442ec850256cf69c0cba7bb9c0b75d2f6c7e134ed33a14dfcee8d064b5

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
522ff47258cacc7fc9e8e3657002360d

SHA1
276c8853739487324d498363ca975557c68a4ffb

SHA256
6e29cb408352f1cf370d2cb941fe3af78626ee5b642422742068c71eb651900e

SHA512
68b6e1bcbd7e20bcc564cf89d59095dace5e01dee00dcc2616136f57a59e5e15c1583ce0fe8e740bf9f061f700ebce4e0855201769fa582f8149538c7a221b39

Download Submit
memory/8-1262-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/260-4802-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/392-2715-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/412-2963-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/436-1506-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/448-1857-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/448-1854-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/464-1155-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/856-45-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/856-95-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/856-93-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/856-46-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1000-2522-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1176-1956-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1180-853-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1180-1858-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1384-4650-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1444-2413-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1476-3606-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1520-2236-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1520-2375-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1572-2316-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1576-2611-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1576-2760-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1588-1868-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1588-949-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1828-4229-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1828-4363-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1888-1957-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1908-1377-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1940-1014-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2032-5510-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2104-667-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2104-4228-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2104-106-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2224-3970-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2276-2246-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2312-2882-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2340-4325-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2364-3000-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2364-2997-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2396-2048-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2396-2051-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2444-1321-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2544-1758-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2612-2620-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2776-3321-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2996-2059-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3016-1866-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3020-1691-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3024-3150-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3152-5073-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3152-5226-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3228-1847-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3240-3412-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3244-5092-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3460-3179-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3488-1825-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3536-5259-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3536-5402-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3548-1619-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3608-2208-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3620-2986-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3696-5359-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3708-4060-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3892-1285-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3948-3885-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3948-3751-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4048-2969-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4048-3133-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4112-1842-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4164-1865-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4260-4631-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4260-4521-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4352-1449-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4364-4700-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4380-2588-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4380-2404-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4388-1844-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4388-2022-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4400-5081-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4400-5084-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4404-4791-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4492-1507-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4584-717-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4584-1845-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4620-5500-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4632-3596-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4748-4753-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4752-2423-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4812-1206-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4816-5490-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4828-2806-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4832-1075-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4860-101-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4860-107-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4996-3762-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5000-42-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/5000-49-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5000-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5000-0-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/5020-2627-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5056-3068-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5068-2795-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download