pony | 3e6331cc838e7e695c24db9d15a0e9667395d62de6ec4897c865bbe62100cfe9

Analysis

max time kernel
142s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2024 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe
Size

2.2MB
MD5

dccce9a581a12f93e20ae819755440ea
SHA1

0c4ddb0585d6cb1d950ff17ba3cbcc80c762f08f
SHA256

3e6331cc838e7e695c24db9d15a0e9667395d62de6ec4897c865bbe62100cfe9
SHA512

1c57e9fae9f7d0ce00a0c4692373b1f8e35fd033f54404ef2863f1cc487e672f5f99a14e30e2879f169d955d06a3de4cda053ae562a81e5b379e6c99f2e629a2
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZT:0UzeyQMS4DqodCnoe+iitjWwwn

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe	dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe	dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
4732	explorer.exe
1204	explorer.exe
5068	spoolsv.exe
3044	spoolsv.exe
1464	spoolsv.exe
1824	spoolsv.exe
3316	spoolsv.exe
3416	spoolsv.exe
4436	spoolsv.exe
2852	spoolsv.exe
4724	spoolsv.exe
5044	spoolsv.exe
4708	spoolsv.exe
316	spoolsv.exe
1596	spoolsv.exe
4388	spoolsv.exe
468	spoolsv.exe
1244	spoolsv.exe
4256	spoolsv.exe
4468	spoolsv.exe
2896	spoolsv.exe
4704	spoolsv.exe
1944	spoolsv.exe
3264	spoolsv.exe
3796	spoolsv.exe
4384	spoolsv.exe
4460	spoolsv.exe
3124	spoolsv.exe
3888	spoolsv.exe
1080	spoolsv.exe
4000	spoolsv.exe
2044	spoolsv.exe
2728	spoolsv.exe
4324	spoolsv.exe
3936	spoolsv.exe
956	spoolsv.exe
1232	spoolsv.exe
4992	spoolsv.exe
1608	explorer.exe
2348	spoolsv.exe
2084	spoolsv.exe
4476	spoolsv.exe
3396	spoolsv.exe
1744	spoolsv.exe
1264	spoolsv.exe
3688	spoolsv.exe
3256	explorer.exe
772	spoolsv.exe
4260	spoolsv.exe
4300	spoolsv.exe
2932	spoolsv.exe
4120	spoolsv.exe
4172	spoolsv.exe
2596	spoolsv.exe
2940	explorer.exe
1684	spoolsv.exe
2348	spoolsv.exe
3592	spoolsv.exe
2684	spoolsv.exe
4972	spoolsv.exe
4464	spoolsv.exe
3880	spoolsv.exe
568	spoolsv.exe
1460	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 50 IoCs

description	pid	Process	procid_target
PID 2216 set thread context of 2252	2216	dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe	97
PID 4732 set thread context of 1204	4732	explorer.exe	101
PID 5068 set thread context of 4992	5068	spoolsv.exe	137
PID 3044 set thread context of 2348	3044	spoolsv.exe	139
PID 1464 set thread context of 2084	1464	spoolsv.exe	140
PID 1824 set thread context of 4476	1824	spoolsv.exe	141
PID 3316 set thread context of 1744	3316	spoolsv.exe	143
PID 3416 set thread context of 1264	3416	spoolsv.exe	144
PID 4436 set thread context of 3688	4436	spoolsv.exe	145
PID 2852 set thread context of 772	2852	spoolsv.exe	147
PID 4724 set thread context of 4260	4724	spoolsv.exe	148
PID 5044 set thread context of 4300	5044	spoolsv.exe	149
PID 316 set thread context of 4172	316	spoolsv.exe	152
PID 1596 set thread context of 2596	1596	spoolsv.exe	153
PID 4388 set thread context of 1684	4388	spoolsv.exe	155
PID 468 set thread context of 2348	468	spoolsv.exe	156
PID 1244 set thread context of 2684	1244	spoolsv.exe	158
PID 4256 set thread context of 4972	4256	spoolsv.exe	159
PID 4468 set thread context of 4464	4468	spoolsv.exe	160
PID 2896 set thread context of 3880	2896	spoolsv.exe	161
PID 4704 set thread context of 568	4704	spoolsv.exe	162
PID 1944 set thread context of 1460	1944	spoolsv.exe	163
PID 3264 set thread context of 1616	3264	spoolsv.exe	164
PID 3796 set thread context of 3932	3796	spoolsv.exe	165
PID 4384 set thread context of 2164	4384	spoolsv.exe	167
PID 4460 set thread context of 1672	4460	spoolsv.exe	169
PID 3124 set thread context of 3332	3124	spoolsv.exe	170
PID 3888 set thread context of 4536	3888	spoolsv.exe	171
PID 1080 set thread context of 4328	1080	spoolsv.exe	172
PID 4000 set thread context of 3676	4000	spoolsv.exe	173
PID 2044 set thread context of 4720	2044	spoolsv.exe	174
PID 2728 set thread context of 988	2728	spoolsv.exe	175
PID 4324 set thread context of 1868	4324	spoolsv.exe	176
PID 3936 set thread context of 3928	3936	spoolsv.exe	179
PID 956 set thread context of 1372	956	spoolsv.exe	180
PID 1232 set thread context of 1796	1232	spoolsv.exe	184
PID 1608 set thread context of 3280	1608	explorer.exe	187
PID 3396 set thread context of 1432	3396	spoolsv.exe	191
PID 3256 set thread context of 1480	3256	explorer.exe	194
PID 2932 set thread context of 2544	2932	spoolsv.exe	198
PID 2940 set thread context of 3728	2940	explorer.exe	208
PID 3592 set thread context of 2072	3592	spoolsv.exe	211
PID 3704 set thread context of 5632	3704	explorer.exe	219
PID 4856 set thread context of 5912	4856	spoolsv.exe	221
PID 1012 set thread context of 5328	1012	spoolsv.exe	224
PID 1948 set thread context of 5384	1948	explorer.exe	225
PID 2160 set thread context of 5848	2160	spoolsv.exe	228
PID 4816 set thread context of 5844	4816	spoolsv.exe	231
PID 4980 set thread context of 5920	4980	explorer.exe	233
PID 2876 set thread context of 6036	2876	spoolsv.exe	234

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2252	dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe
2252	dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1204	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2252	dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe
2252	dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
4992	spoolsv.exe
4992	spoolsv.exe
2348	spoolsv.exe
2348	spoolsv.exe
2084	spoolsv.exe
2084	spoolsv.exe
4476	spoolsv.exe
4476	spoolsv.exe
1744	spoolsv.exe
1744	spoolsv.exe
1264	spoolsv.exe
1264	spoolsv.exe
3688	spoolsv.exe
3688	spoolsv.exe
772	spoolsv.exe
772	spoolsv.exe
4260	spoolsv.exe
4260	spoolsv.exe
4300	spoolsv.exe
4300	spoolsv.exe
4120	spoolsv.exe
4120	spoolsv.exe
4172	spoolsv.exe
4172	spoolsv.exe
2596	spoolsv.exe
2596	spoolsv.exe
1684	spoolsv.exe
1684	spoolsv.exe
2348	spoolsv.exe
2348	spoolsv.exe
2684	spoolsv.exe
2684	spoolsv.exe
4972	spoolsv.exe
4972	spoolsv.exe
4464	spoolsv.exe
4464	spoolsv.exe
3880	spoolsv.exe
3880	spoolsv.exe
568	spoolsv.exe
568	spoolsv.exe
1460	spoolsv.exe
1460	spoolsv.exe
1616	spoolsv.exe
1616	spoolsv.exe
3932	spoolsv.exe
3932	spoolsv.exe
2164	spoolsv.exe
2164	spoolsv.exe
1672	spoolsv.exe
1672	spoolsv.exe
3332	spoolsv.exe
3332	spoolsv.exe
4536	spoolsv.exe
4536	spoolsv.exe
4328	spoolsv.exe
4328	spoolsv.exe
3676	spoolsv.exe
3676	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 3032	2216	dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe	85
PID 2216 wrote to memory of 3032	2216	dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe	85
PID 2216 wrote to memory of 2252	2216	dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe	97
PID 2216 wrote to memory of 2252	2216	dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe	97
PID 2216 wrote to memory of 2252	2216	dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe	97
PID 2216 wrote to memory of 2252	2216	dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe	97
PID 2216 wrote to memory of 2252	2216	dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe	97
PID 2252 wrote to memory of 4732	2252	dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe	98
PID 2252 wrote to memory of 4732	2252	dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe	98
PID 2252 wrote to memory of 4732	2252	dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe	98
PID 4732 wrote to memory of 1204	4732	explorer.exe	101
PID 4732 wrote to memory of 1204	4732	explorer.exe	101
PID 4732 wrote to memory of 1204	4732	explorer.exe	101
PID 4732 wrote to memory of 1204	4732	explorer.exe	101
PID 4732 wrote to memory of 1204	4732	explorer.exe	101
PID 1204 wrote to memory of 5068	1204	explorer.exe	102
PID 1204 wrote to memory of 5068	1204	explorer.exe	102
PID 1204 wrote to memory of 5068	1204	explorer.exe	102
PID 1204 wrote to memory of 3044	1204	explorer.exe	103
PID 1204 wrote to memory of 3044	1204	explorer.exe	103
PID 1204 wrote to memory of 3044	1204	explorer.exe	103
PID 1204 wrote to memory of 1464	1204	explorer.exe	104
PID 1204 wrote to memory of 1464	1204	explorer.exe	104
PID 1204 wrote to memory of 1464	1204	explorer.exe	104
PID 1204 wrote to memory of 1824	1204	explorer.exe	105
PID 1204 wrote to memory of 1824	1204	explorer.exe	105
PID 1204 wrote to memory of 1824	1204	explorer.exe	105
PID 1204 wrote to memory of 3316	1204	explorer.exe	106
PID 1204 wrote to memory of 3316	1204	explorer.exe	106
PID 1204 wrote to memory of 3316	1204	explorer.exe	106
PID 1204 wrote to memory of 3416	1204	explorer.exe	107
PID 1204 wrote to memory of 3416	1204	explorer.exe	107
PID 1204 wrote to memory of 3416	1204	explorer.exe	107
PID 1204 wrote to memory of 4436	1204	explorer.exe	108
PID 1204 wrote to memory of 4436	1204	explorer.exe	108
PID 1204 wrote to memory of 4436	1204	explorer.exe	108
PID 1204 wrote to memory of 2852	1204	explorer.exe	109
PID 1204 wrote to memory of 2852	1204	explorer.exe	109
PID 1204 wrote to memory of 2852	1204	explorer.exe	109
PID 1204 wrote to memory of 4724	1204	explorer.exe	110
PID 1204 wrote to memory of 4724	1204	explorer.exe	110
PID 1204 wrote to memory of 4724	1204	explorer.exe	110
PID 1204 wrote to memory of 5044	1204	explorer.exe	111
PID 1204 wrote to memory of 5044	1204	explorer.exe	111
PID 1204 wrote to memory of 5044	1204	explorer.exe	111
PID 1204 wrote to memory of 4708	1204	explorer.exe	112
PID 1204 wrote to memory of 4708	1204	explorer.exe	112
PID 1204 wrote to memory of 4708	1204	explorer.exe	112
PID 1204 wrote to memory of 316	1204	explorer.exe	113
PID 1204 wrote to memory of 316	1204	explorer.exe	113
PID 1204 wrote to memory of 316	1204	explorer.exe	113
PID 1204 wrote to memory of 1596	1204	explorer.exe	114
PID 1204 wrote to memory of 1596	1204	explorer.exe	114
PID 1204 wrote to memory of 1596	1204	explorer.exe	114
PID 1204 wrote to memory of 4388	1204	explorer.exe	115
PID 1204 wrote to memory of 4388	1204	explorer.exe	115
PID 1204 wrote to memory of 4388	1204	explorer.exe	115
PID 1204 wrote to memory of 468	1204	explorer.exe	116
PID 1204 wrote to memory of 468	1204	explorer.exe	116
PID 1204 wrote to memory of 468	1204	explorer.exe	116
PID 1204 wrote to memory of 1244	1204	explorer.exe	117
PID 1204 wrote to memory of 1244	1204	explorer.exe	117
PID 1204 wrote to memory of 1244	1204	explorer.exe	117
PID 1204 wrote to memory of 4256	1204	explorer.exe	118

C:\Users\Admin\AppData\Local\Temp\dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3032
- C:\Users\Admin\AppData\Local\Temp\dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\dccce9a581a12f93e20ae819755440ea_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2252
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1204
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4992
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1608
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1824
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3416
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3688
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3256
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2852
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4724
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4172
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2940
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:468
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1244
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4468
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2896
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4704
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3264
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3796
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3932
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3704
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4384
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4460
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3124
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3888
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2728
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4324
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1868
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:1948
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1232
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1796
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4980
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1432
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4408
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2932
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2544
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3592
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2072
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4856
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5912
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5328
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2160
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4816
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5844
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2876
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5532
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1980
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5716
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2240
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4268
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5176
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
174054a1ec35900be25afd88a2424f80

SHA1
08f391cf510d21bc71e48be0dfc82b55dff642f8

SHA256
2d405a65c36054231190204b61d9b1914190b8b3ba419da1e419039627eeadf6

SHA512
6d5fe1a73f0e756986d9cdcf15b26d975d87c1c959de342814ba9bf818ae50a86c9048eb84340682bab4131afc68ad32915366e3e87d285c85bf90c5083bcfec

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
1034e8b09ef1031ee1d7c258603c0db2

SHA1
c12f7bdbcf2466cefe69925ce6dfe58fe3d55867

SHA256
40542bea6a32b10e57d42eb3d584aba5884db7b02f2e8e980795bc1c88b49700

SHA512
f60f4e1647b381a9ed36579eb7881b0fce8793f2b8725575ba2534e84fce3e795dca93b0291a113159715a822f1ad4b4c002fde864b1b7f33817ca7746aa54f2

Download Submit
memory/316-1693-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/468-1888-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/772-2555-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/988-3243-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/988-3225-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1204-816-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1204-84-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1204-4499-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1244-1970-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1264-2491-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1372-3339-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1460-2926-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1464-2364-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1464-991-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1480-4040-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1596-1694-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1616-2935-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1672-3114-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1684-2777-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1744-2445-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1796-3629-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1824-1072-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1868-3275-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1944-2239-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2072-5011-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2084-2356-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/2084-2362-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2164-3033-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2164-3037-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2216-33-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2216-27-0x00000000008E0000-0x00000000008E1000-memory.dmp

Filesize
4KB

Download
memory/2216-0-0x00000000008E0000-0x00000000008E1000-memory.dmp

Filesize
4KB

Download
memory/2216-26-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2252-67-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2252-30-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2252-29-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2348-2350-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2348-2347-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2348-2806-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2544-4308-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2596-2767-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2852-1426-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2896-2165-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3044-940-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3044-2348-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3264-2331-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3280-3653-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3316-1178-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3332-3134-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3416-1239-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3688-2740-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3688-2546-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3728-4743-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3796-2344-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3856-6050-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3928-3330-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3932-3025-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3932-3216-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4120-2662-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4120-2667-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4172-2675-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4256-1971-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4260-2568-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4260-2565-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4300-2581-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4300-2576-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4328-3152-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4328-3156-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4384-2346-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4388-1761-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4436-1355-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4460-2361-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4468-2058-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4476-2371-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4476-2375-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4536-3145-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4704-2238-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4708-1625-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4720-3173-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4724-1427-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4732-78-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4732-83-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4992-2336-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4992-2488-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5044-1513-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5068-869-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5068-2338-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5224-6193-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5328-5549-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5328-5707-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5384-5559-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5532-6040-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5632-5387-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5716-6062-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5844-5879-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5848-5645-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5852-6086-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5912-5442-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5920-5901-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6036-5898-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download