pony | d7276ba5ee046c4d450b16f908bccdf6a4fed542ea9f80611f69fe9342aaaf59

Analysis

max time kernel
148s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15-09-2024 10:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe
Size

2.2MB
MD5

e244875948b89c564de2afbd2f745a3e
SHA1

551fd4bae339ed85d8cd0f7fde21a7dea6c88453
SHA256

d7276ba5ee046c4d450b16f908bccdf6a4fed542ea9f80611f69fe9342aaaf59
SHA512

f049bc423794d79da9b6227a06bdcbccca8eba71c1d032f1e1eb83ecca006edc0cb24da4ad342b9437b84ef75ead28b31cda192f18d6847f5052da4e4545e49f
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZt:0UzeyQMS4DqodCnoe+iitjWwwJ

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe	e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe	e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1272	explorer.exe
3216	explorer.exe
2708	spoolsv.exe
2876	spoolsv.exe
1952	spoolsv.exe
5056	spoolsv.exe
2396	spoolsv.exe
1380	spoolsv.exe
4704	spoolsv.exe
1640	spoolsv.exe
2612	spoolsv.exe
2188	spoolsv.exe
2556	spoolsv.exe
2712	spoolsv.exe
3000	spoolsv.exe
4224	spoolsv.exe
1520	spoolsv.exe
2384	spoolsv.exe
4292	spoolsv.exe
1828	spoolsv.exe
2716	spoolsv.exe
2016	spoolsv.exe
1436	spoolsv.exe
4236	spoolsv.exe
2988	spoolsv.exe
1396	spoolsv.exe
1928	spoolsv.exe
1544	spoolsv.exe
4688	spoolsv.exe
2744	spoolsv.exe
3992	spoolsv.exe
4764	spoolsv.exe
1112	spoolsv.exe
1068	spoolsv.exe
4264	spoolsv.exe
4944	spoolsv.exe
4972	spoolsv.exe
1836	spoolsv.exe
992	spoolsv.exe
2020	explorer.exe
3792	spoolsv.exe
5020	spoolsv.exe
4980	spoolsv.exe
4348	spoolsv.exe
3852	spoolsv.exe
4692	spoolsv.exe
1204	spoolsv.exe
4768	spoolsv.exe
216	spoolsv.exe
5048	explorer.exe
4456	spoolsv.exe
1228	spoolsv.exe
4780	spoolsv.exe
3404	spoolsv.exe
1772	spoolsv.exe
2968	spoolsv.exe
4996	spoolsv.exe
3568	spoolsv.exe
1092	spoolsv.exe
4004	spoolsv.exe
3604	explorer.exe
4624	spoolsv.exe
4720	spoolsv.exe
1376	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Suspicious use of SetThreadContext 58 IoCs

description	pid	Process	procid_target
PID 4684 set thread context of 4964	4684	e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe	95
PID 1272 set thread context of 3216	1272	explorer.exe	99
PID 2708 set thread context of 992	2708	spoolsv.exe	136
PID 2876 set thread context of 3792	2876	spoolsv.exe	138
PID 1952 set thread context of 5020	1952	spoolsv.exe	139
PID 5056 set thread context of 4348	5056	spoolsv.exe	141
PID 2396 set thread context of 3852	2396	spoolsv.exe	142
PID 1380 set thread context of 4692	1380	spoolsv.exe	143
PID 4704 set thread context of 1204	4704	spoolsv.exe	144
PID 1640 set thread context of 4768	1640	spoolsv.exe	145
PID 2612 set thread context of 216	2612	spoolsv.exe	146
PID 2188 set thread context of 1228	2188	spoolsv.exe	149
PID 2556 set thread context of 4780	2556	spoolsv.exe	150
PID 2712 set thread context of 3404	2712	spoolsv.exe	151
PID 3000 set thread context of 1772	3000	spoolsv.exe	152
PID 4224 set thread context of 2968	4224	spoolsv.exe	153
PID 1520 set thread context of 4996	1520	spoolsv.exe	154
PID 2384 set thread context of 1092	2384	spoolsv.exe	156
PID 4292 set thread context of 4004	4292	spoolsv.exe	157
PID 1828 set thread context of 4624	1828	spoolsv.exe	159
PID 2716 set thread context of 4720	2716	spoolsv.exe	160
PID 2016 set thread context of 1376	2016	spoolsv.exe	161
PID 1436 set thread context of 1616	1436	spoolsv.exe	162
PID 4236 set thread context of 4816	4236	spoolsv.exe	163
PID 2988 set thread context of 684	2988	spoolsv.exe	164
PID 1396 set thread context of 3232	1396	spoolsv.exe	165
PID 1928 set thread context of 1724	1928	spoolsv.exe	168
PID 1544 set thread context of 1096	1544	spoolsv.exe	169
PID 4688 set thread context of 3272	4688	spoolsv.exe	170
PID 2744 set thread context of 3964	2744	spoolsv.exe	171
PID 3992 set thread context of 224	3992	spoolsv.exe	172
PID 4764 set thread context of 4520	4764	spoolsv.exe	173
PID 1112 set thread context of 3204	1112	spoolsv.exe	174
PID 1068 set thread context of 1384	1068	spoolsv.exe	175
PID 4264 set thread context of 3008	4264	spoolsv.exe	177
PID 4944 set thread context of 1268	4944	spoolsv.exe	178
PID 4972 set thread context of 2212	4972	spoolsv.exe	180
PID 1836 set thread context of 4424	1836	spoolsv.exe	183
PID 2020 set thread context of 3396	2020	explorer.exe	188
PID 4980 set thread context of 2700	4980	spoolsv.exe	190
PID 4456 set thread context of 5092	4456	spoolsv.exe	195
PID 5048 set thread context of 732	5048	explorer.exe	198
PID 3604 set thread context of 4304	3604	explorer.exe	205
PID 3568 set thread context of 868	3568	spoolsv.exe	206
PID 2444 set thread context of 4620	2444	spoolsv.exe	215
PID 3788 set thread context of 3764	3788	explorer.exe	217
PID 4332 set thread context of 5300	4332	spoolsv.exe	219
PID 4008 set thread context of 5356	4008	explorer.exe	220
PID 2516 set thread context of 5432	2516	spoolsv.exe	221
PID 1732 set thread context of 5756	1732	spoolsv.exe	222
PID 4368 set thread context of 5844	4368	explorer.exe	224
PID 736 set thread context of 4800	736	spoolsv.exe	226
PID 2928 set thread context of 4748	2928	spoolsv.exe	227
PID 4992 set thread context of 5868	4992	spoolsv.exe	230
PID 3636 set thread context of 6016	3636	spoolsv.exe	232
PID 4916 set thread context of 6076	4916	explorer.exe	233
PID 1684 set thread context of 5252	1684	spoolsv.exe	235
PID 2908 set thread context of 5784	2908	spoolsv.exe	237

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4964	e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe
4964	e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3216	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4964	e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe
4964	e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
3216	explorer.exe
992	spoolsv.exe
992	spoolsv.exe
3792	spoolsv.exe
3792	spoolsv.exe
5020	spoolsv.exe
5020	spoolsv.exe
4348	spoolsv.exe
4348	spoolsv.exe
3852	spoolsv.exe
3852	spoolsv.exe
4692	spoolsv.exe
4692	spoolsv.exe
1204	spoolsv.exe
1204	spoolsv.exe
4768	spoolsv.exe
4768	spoolsv.exe
216	spoolsv.exe
216	spoolsv.exe
1228	spoolsv.exe
1228	spoolsv.exe
4780	spoolsv.exe
4780	spoolsv.exe
3404	spoolsv.exe
3404	spoolsv.exe
1772	spoolsv.exe
1772	spoolsv.exe
2968	spoolsv.exe
2968	spoolsv.exe
4996	spoolsv.exe
4996	spoolsv.exe
1092	spoolsv.exe
1092	spoolsv.exe
4004	spoolsv.exe
4004	spoolsv.exe
4624	spoolsv.exe
4624	spoolsv.exe
4720	spoolsv.exe
4720	spoolsv.exe
1376	spoolsv.exe
1376	spoolsv.exe
1616	spoolsv.exe
1616	spoolsv.exe
4816	spoolsv.exe
4816	spoolsv.exe
684	spoolsv.exe
684	spoolsv.exe
3232	spoolsv.exe
3232	spoolsv.exe
1724	spoolsv.exe
1724	spoolsv.exe
1096	spoolsv.exe
1096	spoolsv.exe
3272	spoolsv.exe
3272	spoolsv.exe
3964	spoolsv.exe
3964	spoolsv.exe
224	spoolsv.exe
224	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 1444	4684	e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe	84
PID 4684 wrote to memory of 1444	4684	e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe	84
PID 4684 wrote to memory of 4964	4684	e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe	95
PID 4684 wrote to memory of 4964	4684	e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe	95
PID 4684 wrote to memory of 4964	4684	e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe	95
PID 4684 wrote to memory of 4964	4684	e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe	95
PID 4684 wrote to memory of 4964	4684	e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe	95
PID 4964 wrote to memory of 1272	4964	e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe	96
PID 4964 wrote to memory of 1272	4964	e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe	96
PID 4964 wrote to memory of 1272	4964	e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe	96
PID 1272 wrote to memory of 3216	1272	explorer.exe	99
PID 1272 wrote to memory of 3216	1272	explorer.exe	99
PID 1272 wrote to memory of 3216	1272	explorer.exe	99
PID 1272 wrote to memory of 3216	1272	explorer.exe	99
PID 1272 wrote to memory of 3216	1272	explorer.exe	99
PID 3216 wrote to memory of 2708	3216	explorer.exe	100
PID 3216 wrote to memory of 2708	3216	explorer.exe	100
PID 3216 wrote to memory of 2708	3216	explorer.exe	100
PID 3216 wrote to memory of 2876	3216	explorer.exe	101
PID 3216 wrote to memory of 2876	3216	explorer.exe	101
PID 3216 wrote to memory of 2876	3216	explorer.exe	101
PID 3216 wrote to memory of 1952	3216	explorer.exe	102
PID 3216 wrote to memory of 1952	3216	explorer.exe	102
PID 3216 wrote to memory of 1952	3216	explorer.exe	102
PID 3216 wrote to memory of 5056	3216	explorer.exe	103
PID 3216 wrote to memory of 5056	3216	explorer.exe	103
PID 3216 wrote to memory of 5056	3216	explorer.exe	103
PID 3216 wrote to memory of 2396	3216	explorer.exe	104
PID 3216 wrote to memory of 2396	3216	explorer.exe	104
PID 3216 wrote to memory of 2396	3216	explorer.exe	104
PID 3216 wrote to memory of 1380	3216	explorer.exe	105
PID 3216 wrote to memory of 1380	3216	explorer.exe	105
PID 3216 wrote to memory of 1380	3216	explorer.exe	105
PID 3216 wrote to memory of 4704	3216	explorer.exe	106
PID 3216 wrote to memory of 4704	3216	explorer.exe	106
PID 3216 wrote to memory of 4704	3216	explorer.exe	106
PID 3216 wrote to memory of 1640	3216	explorer.exe	107
PID 3216 wrote to memory of 1640	3216	explorer.exe	107
PID 3216 wrote to memory of 1640	3216	explorer.exe	107
PID 3216 wrote to memory of 2612	3216	explorer.exe	108
PID 3216 wrote to memory of 2612	3216	explorer.exe	108
PID 3216 wrote to memory of 2612	3216	explorer.exe	108
PID 3216 wrote to memory of 2188	3216	explorer.exe	109
PID 3216 wrote to memory of 2188	3216	explorer.exe	109
PID 3216 wrote to memory of 2188	3216	explorer.exe	109
PID 3216 wrote to memory of 2556	3216	explorer.exe	110
PID 3216 wrote to memory of 2556	3216	explorer.exe	110
PID 3216 wrote to memory of 2556	3216	explorer.exe	110
PID 3216 wrote to memory of 2712	3216	explorer.exe	111
PID 3216 wrote to memory of 2712	3216	explorer.exe	111
PID 3216 wrote to memory of 2712	3216	explorer.exe	111
PID 3216 wrote to memory of 3000	3216	explorer.exe	112
PID 3216 wrote to memory of 3000	3216	explorer.exe	112
PID 3216 wrote to memory of 3000	3216	explorer.exe	112
PID 3216 wrote to memory of 4224	3216	explorer.exe	113
PID 3216 wrote to memory of 4224	3216	explorer.exe	113
PID 3216 wrote to memory of 4224	3216	explorer.exe	113
PID 3216 wrote to memory of 1520	3216	explorer.exe	114
PID 3216 wrote to memory of 1520	3216	explorer.exe	114
PID 3216 wrote to memory of 1520	3216	explorer.exe	114
PID 3216 wrote to memory of 2384	3216	explorer.exe	115
PID 3216 wrote to memory of 2384	3216	explorer.exe	115
PID 3216 wrote to memory of 2384	3216	explorer.exe	115
PID 3216 wrote to memory of 4292	3216	explorer.exe	116

C:\Users\Admin\AppData\Local\Temp\e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1444
- C:\Users\Admin\AppData\Local\Temp\e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e244875948b89c564de2afbd2f745a3e_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4964
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:992
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2020
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2876
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4704
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1204
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2612
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:216
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5048
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2188
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2556
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2712
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4224
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1520
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2384
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4004
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3604
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1828
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2716
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4236
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2988
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3232
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3788
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2744
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4764
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3204
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4264
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1268
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4008
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4972
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4424
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4368
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4980
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2700
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:4916
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:6076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5092
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4868
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:868
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4620
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2516
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5756
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:736
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5868
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3636
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2908
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5784
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4404
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5276
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2248
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
ef87bec7e76b3df55a07f5ee81755619

SHA1
ccf067cea7e0acbef36c2ba6cdba5abc6805859a

SHA256
7ae420c67ac94ce8d2183d86b06d9bae8c7b17cb90cd25a9e4e268dd7897fc6a

SHA512
ef7fc84cdde649889dc25d97369d4253633eedb5beadb56cd8412922ae60d981e52ea4ccae983a0569d023d13e6edc87bb494d0ea8afa252d6cbc2b9e00788ff

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
2768f1daba1f93b07a1cc3b3fc266dea

SHA1
39a37b57a0b2b6804609d45284f1d068fe2574f3

SHA256
b5116fb37210a145459e072c26cb55780fbed17e2147b267d476ba8df6df6ed6

SHA512
1fd5bfc97d80579beb744646847731aa91a05e752c058c78f01bed18ba513e8814a410892e741d0de274ca732506bc8e3dfaf28e7bee5e295654c7ce16ce1246

Download Submit
memory/216-2685-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/216-2954-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/224-3242-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/684-3030-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/732-4344-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/868-4874-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/992-2667-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/992-2444-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1092-2899-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1096-3213-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1096-3217-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1204-2594-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1204-2590-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1228-2770-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1268-3603-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1272-115-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1272-109-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1376-2999-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1380-1378-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1384-3345-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1396-2453-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1436-2425-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1520-1993-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1544-2475-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1616-3009-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1640-1545-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1724-3206-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1772-2801-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1828-2168-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1928-2454-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1952-1190-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1952-2488-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2016-2323-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2188-1615-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2384-2065-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2396-1377-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2556-1721-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2612-1614-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2700-4118-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2708-2445-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2708-1009-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2712-1803-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2716-2256-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2876-2458-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2876-1120-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2968-2813-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2988-2439-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3000-1855-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3204-3262-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3216-919-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3216-4337-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3216-114-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3232-3131-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3272-3222-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3272-3227-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3396-3983-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3404-2791-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3764-5285-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3792-2455-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3852-2568-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4004-2971-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4224-1992-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4236-2426-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4292-2167-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4304-4766-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4348-2557-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4424-3789-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4620-5438-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4620-5273-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4624-2979-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4684-58-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4684-51-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4684-0-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/4684-52-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/4692-2581-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4692-2577-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4704-1454-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4720-2988-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4748-5573-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4768-2603-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4780-2780-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4800-5559-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4816-3020-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4964-98-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4964-97-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/4964-54-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4964-55-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4996-2825-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4996-2822-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5020-2476-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5056-1301-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5092-4377-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5092-4260-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5252-5870-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5252-5874-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5276-6166-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5356-5386-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5404-6184-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5432-5396-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5756-5671-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5756-5469-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5784-6139-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5788-6179-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5844-5543-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5868-5761-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6076-5784-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download