pony | 6f2e77d66101d7bf65652a9b95b31182881ddebec1bb6d9a80622f7cef4849dd

Analysis

max time kernel
146s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe
Size

2.2MB
MD5

e853a1647b019e150aca4efe1c93e9a3
SHA1

41a06706abbc7353b652e45860f487882512292d
SHA256

6f2e77d66101d7bf65652a9b95b31182881ddebec1bb6d9a80622f7cef4849dd
SHA512

bb273338e377a3638a0d9c079bb4c677fb0fd154e06d37ec31fb4f23233c85647da92f886f40c8fd5ab0e3263ef9946ccca74fa45481764afce81686368027d6
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZn:0UzeyQMS4DqodCnoe+iitjWwwz

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe	e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe	e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
936	explorer.exe
4316	explorer.exe
3052	spoolsv.exe
3704	spoolsv.exe
2108	spoolsv.exe
3456	spoolsv.exe
3752	spoolsv.exe
5056	spoolsv.exe
1032	spoolsv.exe
100	spoolsv.exe
5028	spoolsv.exe
3332	spoolsv.exe
4524	spoolsv.exe
4456	spoolsv.exe
748	spoolsv.exe
4552	spoolsv.exe
3644	spoolsv.exe
3960	spoolsv.exe
2872	spoolsv.exe
848	spoolsv.exe
4076	spoolsv.exe
1976	spoolsv.exe
3956	spoolsv.exe
1968	spoolsv.exe
4476	spoolsv.exe
4512	spoolsv.exe
3512	spoolsv.exe
3972	spoolsv.exe
4144	spoolsv.exe
4020	spoolsv.exe
3392	spoolsv.exe
4560	spoolsv.exe
1836	spoolsv.exe
4748	spoolsv.exe
4684	spoolsv.exe
1184	spoolsv.exe
4644	spoolsv.exe
3440	spoolsv.exe
1624	spoolsv.exe
4812	explorer.exe
1188	spoolsv.exe
1048	spoolsv.exe
1720	spoolsv.exe
380	spoolsv.exe
2316	spoolsv.exe
1684	spoolsv.exe
3004	spoolsv.exe
1292	spoolsv.exe
2452	spoolsv.exe
3912	spoolsv.exe
2728	spoolsv.exe
4284	spoolsv.exe
2124	explorer.exe
3400	spoolsv.exe
2392	spoolsv.exe
3872	spoolsv.exe
1244	spoolsv.exe
2836	spoolsv.exe
2324	spoolsv.exe
1644	spoolsv.exe
4412	explorer.exe
2564	spoolsv.exe
4492	spoolsv.exe
1868	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Suspicious use of SetThreadContext 56 IoCs

description	pid	Process	procid_target
PID 4524 set thread context of 1848	4524	e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe	94
PID 936 set thread context of 4316	936	explorer.exe	98
PID 3052 set thread context of 1624	3052	spoolsv.exe	135
PID 3704 set thread context of 1188	3704	spoolsv.exe	137
PID 2108 set thread context of 1048	2108	spoolsv.exe	138
PID 3456 set thread context of 1720	3456	spoolsv.exe	139
PID 3752 set thread context of 380	3752	spoolsv.exe	140
PID 5056 set thread context of 2316	5056	spoolsv.exe	141
PID 1032 set thread context of 1684	1032	spoolsv.exe	142
PID 100 set thread context of 3004	100	spoolsv.exe	143
PID 5028 set thread context of 2452	5028	spoolsv.exe	145
PID 3332 set thread context of 3912	3332	spoolsv.exe	146
PID 4524 set thread context of 2728	4524	spoolsv.exe	147
PID 4456 set thread context of 4284	4456	spoolsv.exe	148
PID 748 set thread context of 3400	748	spoolsv.exe	150
PID 4552 set thread context of 2392	4552	spoolsv.exe	151
PID 3644 set thread context of 3872	3644	spoolsv.exe	152
PID 3960 set thread context of 1244	3960	spoolsv.exe	153
PID 2872 set thread context of 2836	2872	spoolsv.exe	154
PID 848 set thread context of 1644	848	spoolsv.exe	156
PID 4076 set thread context of 2564	4076	spoolsv.exe	158
PID 1976 set thread context of 4492	1976	spoolsv.exe	159
PID 3956 set thread context of 1868	3956	spoolsv.exe	160
PID 1968 set thread context of 3024	1968	spoolsv.exe	161
PID 4476 set thread context of 1216	4476	spoolsv.exe	163
PID 4512 set thread context of 4900	4512	spoolsv.exe	164
PID 3512 set thread context of 4036	3512	spoolsv.exe	166
PID 3972 set thread context of 5068	3972	spoolsv.exe	167
PID 4144 set thread context of 2208	4144	spoolsv.exe	168
PID 4020 set thread context of 2264	4020	spoolsv.exe	169
PID 3392 set thread context of 436	3392	spoolsv.exe	171
PID 4560 set thread context of 2700	4560	spoolsv.exe	172
PID 1836 set thread context of 2940	1836	spoolsv.exe	173
PID 4748 set thread context of 1780	4748	spoolsv.exe	174
PID 4684 set thread context of 1008	4684	spoolsv.exe	176
PID 1184 set thread context of 3120	1184	spoolsv.exe	177
PID 4644 set thread context of 2968	4644	spoolsv.exe	179
PID 3440 set thread context of 2672	3440	spoolsv.exe	186
PID 4812 set thread context of 3100	4812	explorer.exe	189
PID 1292 set thread context of 3744	1292	spoolsv.exe	194
PID 2124 set thread context of 1932	2124	explorer.exe	196
PID 2324 set thread context of 3164	2324	spoolsv.exe	201
PID 4412 set thread context of 1544	4412	explorer.exe	204
PID 1120 set thread context of 2424	1120	spoolsv.exe	209
PID 3368 set thread context of 1552	3368	explorer.exe	214
PID 392 set thread context of 4312	392	spoolsv.exe	216
PID 1924 set thread context of 3120	1924	explorer.exe	218
PID 64 set thread context of 3408	64	spoolsv.exe	219
PID 3932 set thread context of 2100	3932	explorer.exe	220
PID 4588 set thread context of 1432	4588	spoolsv.exe	222
PID 4128 set thread context of 2412	4128	spoolsv.exe	224
PID 3640 set thread context of 5224	3640	spoolsv.exe	227
PID 3000 set thread context of 5676	3000	spoolsv.exe	230
PID 1260 set thread context of 5736	1260	spoolsv.exe	231
PID 2180 set thread context of 5744	2180	explorer.exe	232
PID 3812 set thread context of 6124	3812	spoolsv.exe	233

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1848	e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe
1848	e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4316	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1848	e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe
1848	e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
4316	explorer.exe
1624	spoolsv.exe
1624	spoolsv.exe
1188	spoolsv.exe
1188	spoolsv.exe
1048	spoolsv.exe
1048	spoolsv.exe
1720	spoolsv.exe
1720	spoolsv.exe
380	spoolsv.exe
380	spoolsv.exe
2316	spoolsv.exe
2316	spoolsv.exe
1684	spoolsv.exe
1684	spoolsv.exe
3004	spoolsv.exe
3004	spoolsv.exe
2452	spoolsv.exe
2452	spoolsv.exe
3912	spoolsv.exe
3912	spoolsv.exe
2728	spoolsv.exe
2728	spoolsv.exe
4284	spoolsv.exe
4284	spoolsv.exe
3400	spoolsv.exe
3400	spoolsv.exe
2392	spoolsv.exe
2392	spoolsv.exe
3872	spoolsv.exe
3872	spoolsv.exe
1244	spoolsv.exe
1244	spoolsv.exe
2836	spoolsv.exe
2836	spoolsv.exe
1644	spoolsv.exe
1644	spoolsv.exe
2564	spoolsv.exe
2564	spoolsv.exe
4492	spoolsv.exe
4492	spoolsv.exe
1868	spoolsv.exe
1868	spoolsv.exe
3024	spoolsv.exe
3024	spoolsv.exe
1216	spoolsv.exe
1216	spoolsv.exe
4900	spoolsv.exe
4900	spoolsv.exe
4036	spoolsv.exe
4036	spoolsv.exe
5068	spoolsv.exe
5068	spoolsv.exe
2208	spoolsv.exe
2208	spoolsv.exe
2264	spoolsv.exe
2264	spoolsv.exe
436	spoolsv.exe
436	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 4240	4524	e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe	85
PID 4524 wrote to memory of 4240	4524	e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe	85
PID 4524 wrote to memory of 1848	4524	e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe	94
PID 4524 wrote to memory of 1848	4524	e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe	94
PID 4524 wrote to memory of 1848	4524	e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe	94
PID 4524 wrote to memory of 1848	4524	e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe	94
PID 4524 wrote to memory of 1848	4524	e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe	94
PID 1848 wrote to memory of 936	1848	e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe	95
PID 1848 wrote to memory of 936	1848	e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe	95
PID 1848 wrote to memory of 936	1848	e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe	95
PID 936 wrote to memory of 4316	936	explorer.exe	98
PID 936 wrote to memory of 4316	936	explorer.exe	98
PID 936 wrote to memory of 4316	936	explorer.exe	98
PID 936 wrote to memory of 4316	936	explorer.exe	98
PID 936 wrote to memory of 4316	936	explorer.exe	98
PID 4316 wrote to memory of 3052	4316	explorer.exe	99
PID 4316 wrote to memory of 3052	4316	explorer.exe	99
PID 4316 wrote to memory of 3052	4316	explorer.exe	99
PID 4316 wrote to memory of 3704	4316	explorer.exe	100
PID 4316 wrote to memory of 3704	4316	explorer.exe	100
PID 4316 wrote to memory of 3704	4316	explorer.exe	100
PID 4316 wrote to memory of 2108	4316	explorer.exe	101
PID 4316 wrote to memory of 2108	4316	explorer.exe	101
PID 4316 wrote to memory of 2108	4316	explorer.exe	101
PID 4316 wrote to memory of 3456	4316	explorer.exe	102
PID 4316 wrote to memory of 3456	4316	explorer.exe	102
PID 4316 wrote to memory of 3456	4316	explorer.exe	102
PID 4316 wrote to memory of 3752	4316	explorer.exe	103
PID 4316 wrote to memory of 3752	4316	explorer.exe	103
PID 4316 wrote to memory of 3752	4316	explorer.exe	103
PID 4316 wrote to memory of 5056	4316	explorer.exe	104
PID 4316 wrote to memory of 5056	4316	explorer.exe	104
PID 4316 wrote to memory of 5056	4316	explorer.exe	104
PID 4316 wrote to memory of 1032	4316	explorer.exe	105
PID 4316 wrote to memory of 1032	4316	explorer.exe	105
PID 4316 wrote to memory of 1032	4316	explorer.exe	105
PID 4316 wrote to memory of 100	4316	explorer.exe	106
PID 4316 wrote to memory of 100	4316	explorer.exe	106
PID 4316 wrote to memory of 100	4316	explorer.exe	106
PID 4316 wrote to memory of 5028	4316	explorer.exe	107
PID 4316 wrote to memory of 5028	4316	explorer.exe	107
PID 4316 wrote to memory of 5028	4316	explorer.exe	107
PID 4316 wrote to memory of 3332	4316	explorer.exe	108
PID 4316 wrote to memory of 3332	4316	explorer.exe	108
PID 4316 wrote to memory of 3332	4316	explorer.exe	108
PID 4316 wrote to memory of 4524	4316	explorer.exe	109
PID 4316 wrote to memory of 4524	4316	explorer.exe	109
PID 4316 wrote to memory of 4524	4316	explorer.exe	109
PID 4316 wrote to memory of 4456	4316	explorer.exe	110
PID 4316 wrote to memory of 4456	4316	explorer.exe	110
PID 4316 wrote to memory of 4456	4316	explorer.exe	110
PID 4316 wrote to memory of 748	4316	explorer.exe	111
PID 4316 wrote to memory of 748	4316	explorer.exe	111
PID 4316 wrote to memory of 748	4316	explorer.exe	111
PID 4316 wrote to memory of 4552	4316	explorer.exe	112
PID 4316 wrote to memory of 4552	4316	explorer.exe	112
PID 4316 wrote to memory of 4552	4316	explorer.exe	112
PID 4316 wrote to memory of 3644	4316	explorer.exe	113
PID 4316 wrote to memory of 3644	4316	explorer.exe	113
PID 4316 wrote to memory of 3644	4316	explorer.exe	113
PID 4316 wrote to memory of 3960	4316	explorer.exe	114
PID 4316 wrote to memory of 3960	4316	explorer.exe	114
PID 4316 wrote to memory of 3960	4316	explorer.exe	114
PID 4316 wrote to memory of 2872	4316	explorer.exe	115

C:\Users\Admin\AppData\Local\Temp\e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4240
- C:\Users\Admin\AppData\Local\Temp\e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e853a1647b019e150aca4efe1c93e9a3_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1848
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:936
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1624
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4812
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3704
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3752
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1032
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:100
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4524
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4284
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2124
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3960
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:848
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1644
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4412
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1976
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1968
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4476
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4900
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3368
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3972
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4144
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1780
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1924
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1184
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2968
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3932
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3440
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2672
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2180
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3744
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2324
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3164
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2424
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:8
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:64
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4588
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4128
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2412
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5224
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3812
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6124
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4264
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1784
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5924
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
b0afeb6595f56af3dd8a9bbf1399966f

SHA1
0dd2e1fde4ac6819f4367b4cfc7f8e4ab6336f5e

SHA256
6228e7bfc1ddeb0b267f42274d4c142c300e839c7e6a901bb372dc91ca51c20c

SHA512
7ba1ec1007bb9a3bea660315d7434dabfe8b200a0eafdc129f08839f721cc6547a46b857a12562d3cfdba5a74821651f850473e58db6c855c2dd98c043bedab6

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
2.2MB

MD5
ba7c0bfd4b44552c52d46c7b08645658

SHA1
7d0fbbd116ebcec9f809af1d687539fd6a7c4a0d

SHA256
e83dad0d1ecbb6f63af2d042d215352651e81dab9d6812bd1fcbb130a4a0b061

SHA512
30bad69a0aaed2f9cf470cc3f935de094a165562364f91d2d15ac34a8ca48b29a28edd8bf0a128b2078e38391d603b9f75f79fd1c3a67fb8a93d4a033d769165

Download Submit
memory/100-1498-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/380-2500-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/436-3218-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/748-1834-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/848-2087-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/936-99-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/936-95-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1008-3294-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1032-1402-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1048-2477-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1188-2464-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1216-3022-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1216-3019-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1244-2751-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1432-5480-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1432-5477-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1544-4714-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1552-5286-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1624-2454-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1624-2670-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1644-2904-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1684-2519-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1720-2489-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1780-3288-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1848-35-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1848-34-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1848-87-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/1848-89-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1868-2933-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1868-2937-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1932-4304-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1968-2375-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1976-2272-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2100-5409-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2108-1123-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2208-3143-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2264-3156-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2316-2512-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2316-2508-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2392-2726-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2392-2730-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2424-5106-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2452-2606-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2564-2915-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2672-3980-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2700-3227-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2728-2640-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2836-2759-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2872-2086-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2968-3564-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3004-2530-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3024-2954-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3052-2455-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3052-991-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3100-4011-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3120-3307-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3120-5392-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3164-4597-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3332-1580-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3400-2717-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3408-5398-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3456-1254-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3512-2476-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3644-1897-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3704-2466-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3704-1057-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3744-4351-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3752-1330-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3872-2739-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3912-2613-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3956-2374-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3960-2024-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3972-2478-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4036-3124-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4036-3126-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4076-2150-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4284-2708-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4284-2878-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4312-5523-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4312-5378-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4316-875-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4316-4367-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4316-101-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4456-1742-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4476-2443-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4492-2925-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4512-2463-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4524-32-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/4524-0-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/4524-1645-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4524-38-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4524-31-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4552-1835-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4900-3267-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5028-1579-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5056-1331-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5068-3138-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5068-3134-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5384-6051-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5468-6063-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5676-5878-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6124-6157-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download