pony | d55313194e6034fc7a205894d5bc46aa07e575d942795278a987c9069a182bf6

Analysis

max time kernel
137s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15-09-2024 07:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe
Size

2.2MB
MD5

e1fad9c8aeac73c4707e5855358e6f3a
SHA1

fcd6b247da305ebb1e7b799b96ee65f61d5acdf0
SHA256

d55313194e6034fc7a205894d5bc46aa07e575d942795278a987c9069a182bf6
SHA512

e807543f9a34dc793b674ce8cec392f3287bf49f158665af6e54be21e6de09407c92b4c1c567dfd730fae6c0bc52487d7e45f07ee442f684705b8a48ee54da03
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZl:0UzeyQMS4DqodCnoe+iitjWwwJ

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
4600	explorer.exe
1684	explorer.exe
4256	spoolsv.exe
2772	spoolsv.exe
3208	spoolsv.exe
5044	spoolsv.exe
4872	spoolsv.exe
3584	spoolsv.exe
1944	spoolsv.exe
4252	spoolsv.exe
4316	spoolsv.exe
3284	spoolsv.exe
3768	spoolsv.exe
1696	spoolsv.exe
2680	spoolsv.exe
3028	spoolsv.exe
4352	spoolsv.exe
368	spoolsv.exe
4748	spoolsv.exe
2872	spoolsv.exe
1704	spoolsv.exe
1052	spoolsv.exe
2400	spoolsv.exe
1304	spoolsv.exe
212	spoolsv.exe
4248	spoolsv.exe
2596	spoolsv.exe
4340	spoolsv.exe
4912	spoolsv.exe
3376	spoolsv.exe
3184	spoolsv.exe
3980	spoolsv.exe
1964	spoolsv.exe
4520	explorer.exe
4488	spoolsv.exe
2184	spoolsv.exe
3724	spoolsv.exe
1484	spoolsv.exe
4356	spoolsv.exe
1836	explorer.exe
2940	spoolsv.exe
3104	spoolsv.exe
5048	spoolsv.exe
4684	spoolsv.exe
2368	spoolsv.exe
548	explorer.exe
2288	spoolsv.exe
4964	spoolsv.exe
3844	spoolsv.exe
4536	spoolsv.exe
4992	explorer.exe
1456	spoolsv.exe
184	spoolsv.exe
2096	spoolsv.exe
4928	spoolsv.exe
4076	spoolsv.exe
3736	explorer.exe
4124	spoolsv.exe
1012	spoolsv.exe
2832	spoolsv.exe
2352	spoolsv.exe
1600	spoolsv.exe
4480	explorer.exe
1860	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 45 IoCs

description	pid	Process	procid_target
PID 2968 set thread context of 1496	2968	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe	95
PID 4600 set thread context of 1684	4600	explorer.exe	99
PID 4256 set thread context of 1964	4256	spoolsv.exe	130
PID 2772 set thread context of 4488	2772	spoolsv.exe	132
PID 3208 set thread context of 2184	3208	spoolsv.exe	133
PID 5044 set thread context of 3724	5044	spoolsv.exe	134
PID 4872 set thread context of 4356	4872	spoolsv.exe	136
PID 3584 set thread context of 2940	3584	spoolsv.exe	138
PID 1944 set thread context of 3104	1944	spoolsv.exe	139
PID 4252 set thread context of 5048	4252	spoolsv.exe	140
PID 4316 set thread context of 2368	4316	spoolsv.exe	142
PID 3284 set thread context of 2288	3284	spoolsv.exe	144
PID 3768 set thread context of 3844	3768	spoolsv.exe	146
PID 1696 set thread context of 4536	1696	spoolsv.exe	147
PID 2680 set thread context of 1456	2680	spoolsv.exe	149
PID 3028 set thread context of 184	3028	spoolsv.exe	150
PID 4352 set thread context of 4928	4352	spoolsv.exe	152
PID 368 set thread context of 4076	368	spoolsv.exe	153
PID 4748 set thread context of 4124	4748	spoolsv.exe	155
PID 2872 set thread context of 1012	2872	spoolsv.exe	156
PID 1704 set thread context of 2352	1704	spoolsv.exe	158
PID 1052 set thread context of 1600	1052	spoolsv.exe	159
PID 2400 set thread context of 1860	2400	spoolsv.exe	161
PID 1304 set thread context of 1028	1304	spoolsv.exe	162
PID 212 set thread context of 908	212	spoolsv.exe	164
PID 4248 set thread context of 4416	4248	spoolsv.exe	165
PID 2596 set thread context of 4672	2596	spoolsv.exe	167
PID 4340 set thread context of 2884	4340	spoolsv.exe	169
PID 4912 set thread context of 1744	4912	spoolsv.exe	170
PID 3376 set thread context of 1072	3376	spoolsv.exe	171
PID 3184 set thread context of 1544	3184	spoolsv.exe	174
PID 3980 set thread context of 2856	3980	spoolsv.exe	177
PID 4520 set thread context of 772	4520	explorer.exe	179
PID 1484 set thread context of 2156	1484	spoolsv.exe	182
PID 1836 set thread context of 4776	1836	explorer.exe	184
PID 4684 set thread context of 1376	4684	spoolsv.exe	186
PID 548 set thread context of 1492	548	explorer.exe	188
PID 4964 set thread context of 4580	4964	spoolsv.exe	191
PID 4992 set thread context of 3948	4992	explorer.exe	195
PID 2096 set thread context of 4424	2096	spoolsv.exe	197
PID 3736 set thread context of 2412	3736	explorer.exe	199
PID 2832 set thread context of 4400	2832	spoolsv.exe	201
PID 4480 set thread context of 772	4480	explorer.exe	205
PID 3732 set thread context of 1228	3732	spoolsv.exe	206
PID 4016 set thread context of 1252	4016	explorer.exe	210

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1496	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe
1496	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1684	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1496	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe
1496	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1684	explorer.exe
1964	spoolsv.exe
1964	spoolsv.exe
4488	spoolsv.exe
4488	spoolsv.exe
2184	spoolsv.exe
2184	spoolsv.exe
3724	spoolsv.exe
3724	spoolsv.exe
4356	spoolsv.exe
4356	spoolsv.exe
2940	spoolsv.exe
2940	spoolsv.exe
3104	spoolsv.exe
3104	spoolsv.exe
5048	spoolsv.exe
5048	spoolsv.exe
2368	spoolsv.exe
2368	spoolsv.exe
2288	spoolsv.exe
2288	spoolsv.exe
3844	spoolsv.exe
3844	spoolsv.exe
4536	spoolsv.exe
4536	spoolsv.exe
1456	spoolsv.exe
1456	spoolsv.exe
184	spoolsv.exe
184	spoolsv.exe
4928	spoolsv.exe
4928	spoolsv.exe
4076	spoolsv.exe
4076	spoolsv.exe
4124	spoolsv.exe
4124	spoolsv.exe
1012	spoolsv.exe
1012	spoolsv.exe
2352	spoolsv.exe
2352	spoolsv.exe
1600	spoolsv.exe
1600	spoolsv.exe
1860	spoolsv.exe
1860	spoolsv.exe
1028	spoolsv.exe
1028	spoolsv.exe
908	spoolsv.exe
908	spoolsv.exe
4416	spoolsv.exe
4416	spoolsv.exe
4672	spoolsv.exe
4672	spoolsv.exe
2884	spoolsv.exe
2884	spoolsv.exe
1744	spoolsv.exe
1744	spoolsv.exe
1072	spoolsv.exe
1072	spoolsv.exe
1544	spoolsv.exe
1544	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 1168	2968	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe	83
PID 2968 wrote to memory of 1168	2968	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe	83
PID 2968 wrote to memory of 1496	2968	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe	95
PID 2968 wrote to memory of 1496	2968	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe	95
PID 2968 wrote to memory of 1496	2968	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe	95
PID 2968 wrote to memory of 1496	2968	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe	95
PID 2968 wrote to memory of 1496	2968	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe	95
PID 1496 wrote to memory of 4600	1496	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe	96
PID 1496 wrote to memory of 4600	1496	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe	96
PID 1496 wrote to memory of 4600	1496	e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe	96
PID 4600 wrote to memory of 1684	4600	explorer.exe	99
PID 4600 wrote to memory of 1684	4600	explorer.exe	99
PID 4600 wrote to memory of 1684	4600	explorer.exe	99
PID 4600 wrote to memory of 1684	4600	explorer.exe	99
PID 4600 wrote to memory of 1684	4600	explorer.exe	99
PID 1684 wrote to memory of 4256	1684	explorer.exe	100
PID 1684 wrote to memory of 4256	1684	explorer.exe	100
PID 1684 wrote to memory of 4256	1684	explorer.exe	100
PID 1684 wrote to memory of 2772	1684	explorer.exe	101
PID 1684 wrote to memory of 2772	1684	explorer.exe	101
PID 1684 wrote to memory of 2772	1684	explorer.exe	101
PID 1684 wrote to memory of 3208	1684	explorer.exe	102
PID 1684 wrote to memory of 3208	1684	explorer.exe	102
PID 1684 wrote to memory of 3208	1684	explorer.exe	102
PID 1684 wrote to memory of 5044	1684	explorer.exe	103
PID 1684 wrote to memory of 5044	1684	explorer.exe	103
PID 1684 wrote to memory of 5044	1684	explorer.exe	103
PID 1684 wrote to memory of 4872	1684	explorer.exe	104
PID 1684 wrote to memory of 4872	1684	explorer.exe	104
PID 1684 wrote to memory of 4872	1684	explorer.exe	104
PID 1684 wrote to memory of 3584	1684	explorer.exe	105
PID 1684 wrote to memory of 3584	1684	explorer.exe	105
PID 1684 wrote to memory of 3584	1684	explorer.exe	105
PID 1684 wrote to memory of 1944	1684	explorer.exe	106
PID 1684 wrote to memory of 1944	1684	explorer.exe	106
PID 1684 wrote to memory of 1944	1684	explorer.exe	106
PID 1684 wrote to memory of 4252	1684	explorer.exe	107
PID 1684 wrote to memory of 4252	1684	explorer.exe	107
PID 1684 wrote to memory of 4252	1684	explorer.exe	107
PID 1684 wrote to memory of 4316	1684	explorer.exe	108
PID 1684 wrote to memory of 4316	1684	explorer.exe	108
PID 1684 wrote to memory of 4316	1684	explorer.exe	108
PID 1684 wrote to memory of 3284	1684	explorer.exe	109
PID 1684 wrote to memory of 3284	1684	explorer.exe	109
PID 1684 wrote to memory of 3284	1684	explorer.exe	109
PID 1684 wrote to memory of 3768	1684	explorer.exe	110
PID 1684 wrote to memory of 3768	1684	explorer.exe	110
PID 1684 wrote to memory of 3768	1684	explorer.exe	110
PID 1684 wrote to memory of 1696	1684	explorer.exe	111
PID 1684 wrote to memory of 1696	1684	explorer.exe	111
PID 1684 wrote to memory of 1696	1684	explorer.exe	111
PID 1684 wrote to memory of 2680	1684	explorer.exe	112
PID 1684 wrote to memory of 2680	1684	explorer.exe	112
PID 1684 wrote to memory of 2680	1684	explorer.exe	112
PID 1684 wrote to memory of 3028	1684	explorer.exe	113
PID 1684 wrote to memory of 3028	1684	explorer.exe	113
PID 1684 wrote to memory of 3028	1684	explorer.exe	113
PID 1684 wrote to memory of 4352	1684	explorer.exe	114
PID 1684 wrote to memory of 4352	1684	explorer.exe	114
PID 1684 wrote to memory of 4352	1684	explorer.exe	114
PID 1684 wrote to memory of 368	1684	explorer.exe	115
PID 1684 wrote to memory of 368	1684	explorer.exe	115
PID 1684 wrote to memory of 368	1684	explorer.exe	115
PID 1684 wrote to memory of 4748	1684	explorer.exe	116

C:\Users\Admin\AppData\Local\Temp\e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1168
- C:\Users\Admin\AppData\Local\Temp\e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e1fad9c8aeac73c4707e5855358e6f3a_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1496
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1964
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4520
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2772
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4356
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1836
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4252
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2368
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:548
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3284
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1696
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4536
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4992
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2680
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4352
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:368
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4076
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3736
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1704
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1600
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4480
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:212
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4248
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4672
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4016
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4340
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4912
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1072
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4296
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3184
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3980
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2856
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3276
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2156
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1516
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1376
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1804
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4580
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2096
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4424
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4400
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1228
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4024
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3664
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1672
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3508
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3920
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4880
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4384
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2576
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1136
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
79e337c47f8dcc5eccfce69305fecbed

SHA1
e40de05c828aaf310825a285cb11483c0f76b26e

SHA256
c4fb5ae97a4a9caf10da7edb2933e1b1b4b91b680425097a2087bf0b480ba42e

SHA512
f00472f9e7c9fd7672c84090854bbc077d2ca7a42246b4a02dccde96cae6ea4d9c78c016bbf17b62b2d322f195f300f937152198ca818d328c849b49e949900d

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
5744187311beba8230226df1d2e8a6d4

SHA1
963629f1b4a5b6050f74ca1a6027e1bcd0f782a7

SHA256
015145b6d820f975dfc534420390a7b14a9f6bf7421785c5054691a3ba2646a2

SHA512
48e4cfd152ebc2632c39496c62b40e0b5f17da02440be02408cf9ab0c33c1c8d2139f3154b1d8915029edef39a52c5b1c62973b921da8a26528659ba0a7df6e6

Download Submit
memory/184-2563-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/184-2566-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/212-1995-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/368-1760-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/772-3422-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/772-4466-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/908-2938-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/908-2935-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1012-2681-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1012-2678-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1028-2888-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1052-1963-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1072-3239-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1100-5108-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1228-4584-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1252-4679-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1304-1989-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1376-3899-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1376-3771-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1456-2488-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1456-2491-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1492-3781-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1496-73-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1496-72-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/1496-40-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1496-39-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1544-3265-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1600-2835-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1600-3002-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1684-89-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1684-4159-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1684-675-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1696-1507-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1704-1896-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1744-3123-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1860-2844-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1944-1241-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1964-1964-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1964-2118-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2156-3619-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2184-1983-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2184-1987-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2352-2749-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2352-2753-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2400-1981-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2412-4225-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2576-5328-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2680-1559-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2772-886-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2772-1975-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2856-3413-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2872-1895-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2884-3111-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2940-2165-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2968-42-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2968-0-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/2968-36-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2968-37-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/2980-5117-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3028-1626-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3104-2174-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3208-957-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3208-1985-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3284-1374-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3508-4979-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3532-5214-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3584-1140-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3660-4767-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3664-4685-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3664-4840-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3724-1997-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3724-2001-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3768-1446-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3832-5338-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3844-2432-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3920-5179-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3920-5098-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3948-4131-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4076-2805-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4076-2661-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4124-2669-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4252-1312-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4256-742-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4256-1965-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4316-1313-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4352-1693-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4356-2311-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4356-2136-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4384-5210-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4384-5307-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4400-4404-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4416-2947-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4424-4204-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4424-4282-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4488-1973-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4488-1977-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4536-2479-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4580-4057-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4600-84-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4600-90-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4668-4787-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4672-3103-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4748-1827-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4776-3630-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4872-1069-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4928-2584-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5044-1003-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5048-2196-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5064-5354-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download