pony | 123512a51a233f66e19c39e6f5bea822a99f6b01203a66b148f4def956d80024

Analysis

max time kernel
146s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-09-2024 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe
Size

2.2MB
MD5

e3127576d17b4497abab7625a3136fb2
SHA1

7062b1948f7c563af1e44faa880a9f79b77926f5
SHA256

123512a51a233f66e19c39e6f5bea822a99f6b01203a66b148f4def956d80024
SHA512

c4e9bb30546eb5610e0914a6d9b86a778931cb158352bfc2df8ba8170fe1377cb25c87ce9b5cea7ac436344d68b42937fec80684f487ce89d87aabaf63956d6c
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZL:0UzeyQMS4DqodCnoe+iitjWww3

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
2056	explorer.exe
2272	explorer.exe
2552	spoolsv.exe
2148	spoolsv.exe
2344	spoolsv.exe
544	spoolsv.exe
1704	spoolsv.exe
2712	spoolsv.exe
2644	spoolsv.exe
1952	spoolsv.exe
376	spoolsv.exe
1848	spoolsv.exe
1392	spoolsv.exe
2952	spoolsv.exe
3052	spoolsv.exe
2756	spoolsv.exe
3036	spoolsv.exe
1012	spoolsv.exe
2376	spoolsv.exe
936	spoolsv.exe
3000	spoolsv.exe
1072	spoolsv.exe
2740	spoolsv.exe
1940	spoolsv.exe
2172	spoolsv.exe
1076	spoolsv.exe
1416	spoolsv.exe
2488	spoolsv.exe
2688	spoolsv.exe
552	spoolsv.exe
2056	spoolsv.exe
2348	spoolsv.exe
1500	spoolsv.exe
3048	spoolsv.exe
2572	spoolsv.exe
2208	spoolsv.exe
2356	spoolsv.exe
1576	spoolsv.exe
3008	spoolsv.exe
2116	spoolsv.exe
2364	spoolsv.exe
2028	spoolsv.exe
1560	spoolsv.exe
2156	spoolsv.exe
1772	spoolsv.exe
2308	spoolsv.exe
2744	spoolsv.exe
1004	spoolsv.exe
2260	spoolsv.exe
1140	spoolsv.exe
1660	spoolsv.exe
1596	spoolsv.exe
2040	spoolsv.exe
1328	spoolsv.exe
1068	spoolsv.exe
2588	spoolsv.exe
1868	spoolsv.exe
1020	spoolsv.exe
436	spoolsv.exe
2780	spoolsv.exe
1672	spoolsv.exe
2144	explorer.exe
2300	spoolsv.exe
1492	spoolsv.exe

Loads dropped DLL 64 IoCs

pid	Process
2684	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe
2684	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 58 IoCs

description	pid	Process	procid_target
PID 2248 set thread context of 2684	2248	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe	31
PID 2056 set thread context of 2272	2056	explorer.exe	33
PID 2552 set thread context of 1672	2552	spoolsv.exe	93
PID 2148 set thread context of 2300	2148	spoolsv.exe	95
PID 544 set thread context of 1492	544	spoolsv.exe	96
PID 2344 set thread context of 2932	2344	spoolsv.exe	97
PID 2712 set thread context of 2620	2712	spoolsv.exe	99
PID 1704 set thread context of 3136	1704	spoolsv.exe	100
PID 376 set thread context of 3676	376	spoolsv.exe	103
PID 2644 set thread context of 3872	2644	spoolsv.exe	104
PID 1392 set thread context of 3960	1392	spoolsv.exe	105
PID 1952 set thread context of 1360	1952	spoolsv.exe	107
PID 3052 set thread context of 3296	3052	spoolsv.exe	109
PID 1848 set thread context of 3460	1848	spoolsv.exe	110
PID 3036 set thread context of 3140	3036	spoolsv.exe	111
PID 2952 set thread context of 916	2952	spoolsv.exe	112
PID 2376 set thread context of 3768	2376	spoolsv.exe	113
PID 436 set thread context of 3828	436	spoolsv.exe	114
PID 2756 set thread context of 4064	2756	spoolsv.exe	115
PID 3000 set thread context of 3996	3000	spoolsv.exe	116
PID 2740 set thread context of 3184	2740	spoolsv.exe	117
PID 1012 set thread context of 3196	1012	spoolsv.exe	118
PID 2172 set thread context of 3856	2172	spoolsv.exe	120
PID 936 set thread context of 3284	936	spoolsv.exe	121
PID 1416 set thread context of 1936	1416	spoolsv.exe	122
PID 1072 set thread context of 3360	1072	spoolsv.exe	123
PID 2056 set thread context of 3444	2056	spoolsv.exe	125
PID 1940 set thread context of 3376	1940	spoolsv.exe	124
PID 1500 set thread context of 1696	1500	spoolsv.exe	127
PID 2688 set thread context of 3616	2688	spoolsv.exe	126
PID 2572 set thread context of 564	2572	spoolsv.exe	129
PID 1076 set thread context of 3604	1076	spoolsv.exe	128
PID 2356 set thread context of 648	2356	spoolsv.exe	130
PID 3008 set thread context of 2324	3008	spoolsv.exe	133
PID 2364 set thread context of 3888	2364	spoolsv.exe	132
PID 552 set thread context of 4024	552	spoolsv.exe	134
PID 1560 set thread context of 3952	1560	spoolsv.exe	135
PID 2348 set thread context of 3968	2348	spoolsv.exe	136
PID 1772 set thread context of 1624	1772	spoolsv.exe	137
PID 2260 set thread context of 4092	2260	spoolsv.exe	139
PID 2744 set thread context of 1700	2744	spoolsv.exe	138
PID 2040 set thread context of 1556	2040	spoolsv.exe	143
PID 2208 set thread context of 1516	2208	spoolsv.exe	145
PID 1660 set thread context of 3004	1660	spoolsv.exe	140
PID 2116 set thread context of 1900	2116	spoolsv.exe	141
PID 1068 set thread context of 2460	1068	spoolsv.exe	142
PID 3048 set thread context of 3408	3048	spoolsv.exe	147
PID 1868 set thread context of 3208	1868	spoolsv.exe	144
PID 1576 set thread context of 3280	1576	spoolsv.exe	149
PID 1140 set thread context of 1928	1140	spoolsv.exe	148
PID 2028 set thread context of 3592	2028	spoolsv.exe	151
PID 1328 set thread context of 524	1328	spoolsv.exe	150
PID 2156 set thread context of 1160	2156	spoolsv.exe	153
PID 1596 set thread context of 2828	1596	spoolsv.exe	152
PID 2308 set thread context of 3700	2308	spoolsv.exe	154
PID 1020 set thread context of 3708	1020	spoolsv.exe	155
PID 1004 set thread context of 2080	1004	spoolsv.exe	156
PID 2588 set thread context of 3908	2588	spoolsv.exe	157

Drops file in Windows directory 62 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2684	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2272	explorer.exe

Suspicious use of SetWindowsHookEx 62 IoCs

pid	Process
2684	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe
2684	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
1672	spoolsv.exe
1672	spoolsv.exe
2300	spoolsv.exe
2300	spoolsv.exe
1492	spoolsv.exe
1492	spoolsv.exe
2932	spoolsv.exe
2932	spoolsv.exe
2620	spoolsv.exe
2620	spoolsv.exe
3136	spoolsv.exe
3136	spoolsv.exe
3676	spoolsv.exe
3676	spoolsv.exe
3872	spoolsv.exe
3872	spoolsv.exe
3960	spoolsv.exe
3960	spoolsv.exe
1360	spoolsv.exe
1360	spoolsv.exe
3296	spoolsv.exe
3296	spoolsv.exe
3460	spoolsv.exe
3460	spoolsv.exe
3140	spoolsv.exe
3140	spoolsv.exe
916	spoolsv.exe
916	spoolsv.exe
3768	spoolsv.exe
3768	spoolsv.exe
3828	spoolsv.exe
4064	spoolsv.exe
4064	spoolsv.exe
3828	spoolsv.exe
3996	spoolsv.exe
3196	spoolsv.exe
3196	spoolsv.exe
3996	spoolsv.exe
3184	spoolsv.exe
3856	spoolsv.exe
3856	spoolsv.exe
3184	spoolsv.exe
3284	spoolsv.exe
3284	spoolsv.exe
3616	spoolsv.exe
3616	spoolsv.exe
1696	spoolsv.exe
1696	spoolsv.exe
564	spoolsv.exe
564	spoolsv.exe
2324	spoolsv.exe
2324	spoolsv.exe
3604	spoolsv.exe
3604	spoolsv.exe
648	spoolsv.exe
648	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2788	2248	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2788	2248	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2788	2248	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2788	2248	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2684	2248	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe	31
PID 2248 wrote to memory of 2684	2248	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe	31
PID 2248 wrote to memory of 2684	2248	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe	31
PID 2248 wrote to memory of 2684	2248	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe	31
PID 2248 wrote to memory of 2684	2248	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe	31
PID 2248 wrote to memory of 2684	2248	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe	31
PID 2684 wrote to memory of 2056	2684	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe	32
PID 2684 wrote to memory of 2056	2684	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe	32
PID 2684 wrote to memory of 2056	2684	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe	32
PID 2684 wrote to memory of 2056	2684	e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe	32
PID 2056 wrote to memory of 2272	2056	explorer.exe	33
PID 2056 wrote to memory of 2272	2056	explorer.exe	33
PID 2056 wrote to memory of 2272	2056	explorer.exe	33
PID 2056 wrote to memory of 2272	2056	explorer.exe	33
PID 2056 wrote to memory of 2272	2056	explorer.exe	33
PID 2056 wrote to memory of 2272	2056	explorer.exe	33
PID 2272 wrote to memory of 2552	2272	explorer.exe	34
PID 2272 wrote to memory of 2552	2272	explorer.exe	34
PID 2272 wrote to memory of 2552	2272	explorer.exe	34
PID 2272 wrote to memory of 2552	2272	explorer.exe	34
PID 2272 wrote to memory of 2148	2272	explorer.exe	35
PID 2272 wrote to memory of 2148	2272	explorer.exe	35
PID 2272 wrote to memory of 2148	2272	explorer.exe	35
PID 2272 wrote to memory of 2148	2272	explorer.exe	35
PID 2272 wrote to memory of 2344	2272	explorer.exe	36
PID 2272 wrote to memory of 2344	2272	explorer.exe	36
PID 2272 wrote to memory of 2344	2272	explorer.exe	36
PID 2272 wrote to memory of 2344	2272	explorer.exe	36
PID 2272 wrote to memory of 544	2272	explorer.exe	37
PID 2272 wrote to memory of 544	2272	explorer.exe	37
PID 2272 wrote to memory of 544	2272	explorer.exe	37
PID 2272 wrote to memory of 544	2272	explorer.exe	37
PID 2272 wrote to memory of 1704	2272	explorer.exe	38
PID 2272 wrote to memory of 1704	2272	explorer.exe	38
PID 2272 wrote to memory of 1704	2272	explorer.exe	38
PID 2272 wrote to memory of 1704	2272	explorer.exe	38
PID 2272 wrote to memory of 2712	2272	explorer.exe	39
PID 2272 wrote to memory of 2712	2272	explorer.exe	39
PID 2272 wrote to memory of 2712	2272	explorer.exe	39
PID 2272 wrote to memory of 2712	2272	explorer.exe	39
PID 2272 wrote to memory of 2644	2272	explorer.exe	40
PID 2272 wrote to memory of 2644	2272	explorer.exe	40
PID 2272 wrote to memory of 2644	2272	explorer.exe	40
PID 2272 wrote to memory of 2644	2272	explorer.exe	40
PID 2272 wrote to memory of 1952	2272	explorer.exe	42
PID 2272 wrote to memory of 1952	2272	explorer.exe	42
PID 2272 wrote to memory of 1952	2272	explorer.exe	42
PID 2272 wrote to memory of 1952	2272	explorer.exe	42
PID 2272 wrote to memory of 376	2272	explorer.exe	43
PID 2272 wrote to memory of 376	2272	explorer.exe	43
PID 2272 wrote to memory of 376	2272	explorer.exe	43
PID 2272 wrote to memory of 376	2272	explorer.exe	43
PID 2272 wrote to memory of 1848	2272	explorer.exe	44
PID 2272 wrote to memory of 1848	2272	explorer.exe	44
PID 2272 wrote to memory of 1848	2272	explorer.exe	44
PID 2272 wrote to memory of 1848	2272	explorer.exe	44
PID 2272 wrote to memory of 1392	2272	explorer.exe	45
PID 2272 wrote to memory of 1392	2272	explorer.exe	45
PID 2272 wrote to memory of 1392	2272	explorer.exe	45
PID 2272 wrote to memory of 1392	2272	explorer.exe	45

C:\Users\Admin\AppData\Local\Temp\e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2788
- C:\Users\Admin\AppData\Local\Temp\e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e3127576d17b4497abab7625a3136fb2_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2684
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1672
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        
        PID:2144
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2344
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1704
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3136
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3240
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2712
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3872
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1848
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2756
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1072
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2740
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1940
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2172
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1416
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2488
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2348
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1500
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3048
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2356
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1576
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2116
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2156
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1772
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2308
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2744
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1004
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1140
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1660
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2588
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3172
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
\Windows\system\explorer.exe

Filesize
2.2MB

MD5
9bdd1b9c772d37d124b0b3ce656de4f6

SHA1
f430ebb4c37ba48b9852f60c25c4bf77c4ef3dbf

SHA256
2ce801b3bc377efd0af3afe4e17238da00726373fa2403379e65c631952d706b

SHA512
f86a6444c40f7ff2ee549a9c7d66c7f2fdd19b5d5a9e4f31ea39f80db0e61856a456d3b65fec5c136384685513fda4732f41ec23febffd3f9bab5a7ce8b3f337

Download Submit
\Windows\system\spoolsv.exe

Filesize
2.2MB

MD5
58aeaee2113a57f1b320c9575243df2a

SHA1
675e18df34c5ee8b84e1723c132c4e949aa5fc02

SHA256
4d8bb17430f1b7225e8ec916888ae8b925938e73af7adec9cd12af3d80026d5c

SHA512
a5404e5f81c0a79362ac49ae5cb66bc980806992970844baab232038dcb50b3fa2a5fe648f2db79210f1ffa8c2c7302b90d0c1e5ea513a4eb2eb84b638a556b9

Download Submit
memory/376-1503-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/544-1100-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/552-1973-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/936-1718-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1012-1653-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1072-1720-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1076-1861-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1360-2556-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1392-1505-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1416-1862-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1492-2345-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1516-3130-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1672-2409-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1672-2314-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1704-1186-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1848-1504-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1900-3134-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1940-1782-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1952-1502-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2056-68-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2056-1974-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2056-59-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2056-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2148-1030-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2172-1783-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2248-27-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2248-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2248-16-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2248-17-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2272-818-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2300-2324-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2344-1039-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2348-2022-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2376-1654-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2488-1863-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2488-1866-0x0000000002BF0000-0x0000000002D4C000-memory.dmp

Filesize
1.4MB

Download
memory/2552-939-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2620-2396-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2644-1401-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2684-26-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2684-19-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2684-30-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2684-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2684-48-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2684-23-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2688-1972-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2712-1302-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2740-1781-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2756-1581-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2932-2363-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2952-1579-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3000-1719-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3036-1652-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3052-1580-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3136-2439-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3136-2504-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3184-3123-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3196-3069-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3284-3122-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3296-2595-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3360-3124-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3592-3135-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3604-3126-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3616-3125-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3676-2493-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3768-2686-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3828-3085-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3856-3114-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3872-2532-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3888-3127-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3908-3141-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3960-2537-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3968-3142-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3996-3121-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download