pony | 5b946512e17f1f2b12a5f72cf600b982aa1612a4a1233f391e1d69ac051a77ed

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2024 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe
Size

2.2MB
MD5

f7d189a35f35f41f2cc955e8e07aac42
SHA1

5e7b297075eca6ab61c911a0fd316c8c60588ebe
SHA256

5b946512e17f1f2b12a5f72cf600b982aa1612a4a1233f391e1d69ac051a77ed
SHA512

aca9a54eaa169ea41007704a313d4e733199e1f283adc27edee148a47a21168e4f1ebc92f19ffa811919b8c32c045cb76d604cb3b2285cff21578c86249a8bb1
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ1:0UzeyQMS4DqodCnoe+iitjWwwh

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe	f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe	f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
3920	explorer.exe
1200	explorer.exe
2948	spoolsv.exe
3264	spoolsv.exe
2616	spoolsv.exe
1572	spoolsv.exe
1364	spoolsv.exe
2792	spoolsv.exe
452	spoolsv.exe
1576	spoolsv.exe
4492	spoolsv.exe
3060	spoolsv.exe
4676	spoolsv.exe
2244	spoolsv.exe
4888	spoolsv.exe
3844	spoolsv.exe
3624	spoolsv.exe
1580	spoolsv.exe
3048	spoolsv.exe
3524	spoolsv.exe
4972	spoolsv.exe
3388	spoolsv.exe
1684	spoolsv.exe
2940	spoolsv.exe
4452	spoolsv.exe
4480	spoolsv.exe
1600	spoolsv.exe
4864	spoolsv.exe
4948	spoolsv.exe
1552	spoolsv.exe
4504	spoolsv.exe
860	spoolsv.exe
4868	spoolsv.exe
1828	spoolsv.exe
4576	spoolsv.exe
1036	spoolsv.exe
5112	explorer.exe
1916	spoolsv.exe
2484	spoolsv.exe
896	spoolsv.exe
1708	spoolsv.exe
316	spoolsv.exe
4916	spoolsv.exe
1076	spoolsv.exe
4236	spoolsv.exe
4900	spoolsv.exe
4680	explorer.exe
3760	spoolsv.exe
4108	spoolsv.exe
4052	spoolsv.exe
4008	spoolsv.exe
2320	spoolsv.exe
5036	spoolsv.exe
764	spoolsv.exe
2228	explorer.exe
5080	spoolsv.exe
4044	spoolsv.exe
4216	spoolsv.exe
1716	spoolsv.exe
3028	spoolsv.exe
464	spoolsv.exe
3488	spoolsv.exe
3392	explorer.exe
5068	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 56 IoCs

description	pid	Process	procid_target
PID 5080 set thread context of 4116	5080	f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe	91
PID 3920 set thread context of 1200	3920	explorer.exe	95
PID 2948 set thread context of 1036	2948	spoolsv.exe	129
PID 3264 set thread context of 1916	3264	spoolsv.exe	131
PID 2616 set thread context of 2484	2616	spoolsv.exe	132
PID 1572 set thread context of 1708	1572	spoolsv.exe	134
PID 1364 set thread context of 316	1364	spoolsv.exe	135
PID 2792 set thread context of 4916	2792	spoolsv.exe	136
PID 452 set thread context of 1076	452	spoolsv.exe	137
PID 1576 set thread context of 4900	1576	spoolsv.exe	139
PID 4492 set thread context of 3760	4492	spoolsv.exe	141
PID 3060 set thread context of 4108	3060	spoolsv.exe	142
PID 4676 set thread context of 4052	4676	spoolsv.exe	143
PID 2244 set thread context of 4008	2244	spoolsv.exe	144
PID 4888 set thread context of 2320	4888	spoolsv.exe	145
PID 3844 set thread context of 764	3844	spoolsv.exe	147
PID 3624 set thread context of 5080	3624	spoolsv.exe	149
PID 1580 set thread context of 4044	1580	spoolsv.exe	150
PID 3048 set thread context of 4216	3048	spoolsv.exe	151
PID 3524 set thread context of 3028	3524	spoolsv.exe	153
PID 4972 set thread context of 464	4972	spoolsv.exe	154
PID 3388 set thread context of 3488	3388	spoolsv.exe	155
PID 1684 set thread context of 5068	1684	spoolsv.exe	157
PID 2940 set thread context of 1420	2940	spoolsv.exe	158
PID 4452 set thread context of 4620	4452	spoolsv.exe	159
PID 4480 set thread context of 4176	4480	spoolsv.exe	160
PID 1600 set thread context of 1372	1600	spoolsv.exe	162
PID 4864 set thread context of 1424	4864	spoolsv.exe	164
PID 4948 set thread context of 4872	4948	spoolsv.exe	165
PID 1552 set thread context of 4604	1552	spoolsv.exe	166
PID 4504 set thread context of 5108	4504	spoolsv.exe	167
PID 860 set thread context of 4524	860	spoolsv.exe	169
PID 4868 set thread context of 1960	4868	spoolsv.exe	171
PID 1828 set thread context of 2528	1828	spoolsv.exe	172
PID 4576 set thread context of 1904	4576	spoolsv.exe	175
PID 5112 set thread context of 3240	5112	explorer.exe	180
PID 896 set thread context of 2980	896	spoolsv.exe	181
PID 4680 set thread context of 3640	4680	explorer.exe	186
PID 4236 set thread context of 4456	4236	spoolsv.exe	188
PID 5036 set thread context of 3492	5036	spoolsv.exe	194
PID 2228 set thread context of 3564	2228	explorer.exe	197
PID 1716 set thread context of 1792	1716	spoolsv.exe	202
PID 3392 set thread context of 2144	3392	explorer.exe	204
PID 4104 set thread context of 976	4104	spoolsv.exe	208
PID 3480 set thread context of 1764	3480	explorer.exe	210
PID 1188 set thread context of 1568	1188	explorer.exe	212
PID 1756 set thread context of 2360	1756	spoolsv.exe	213
PID 928 set thread context of 5256	928	spoolsv.exe	216
PID 4392 set thread context of 5336	4392	spoolsv.exe	217
PID 4628 set thread context of 5896	4628	explorer.exe	219
PID 2748 set thread context of 6008	2748	spoolsv.exe	220
PID 3260 set thread context of 6124	3260	spoolsv.exe	222
PID 4312 set thread context of 5548	4312	spoolsv.exe	224
PID 3812 set thread context of 5508	3812	explorer.exe	226
PID 3076 set thread context of 5828	3076	spoolsv.exe	228
PID 872 set thread context of 5980	872	spoolsv.exe	229

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4116	f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe
4116	f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1200	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4116	f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe
4116	f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1036	spoolsv.exe
1036	spoolsv.exe
1916	spoolsv.exe
1916	spoolsv.exe
2484	spoolsv.exe
2484	spoolsv.exe
1708	spoolsv.exe
1708	spoolsv.exe
316	spoolsv.exe
316	spoolsv.exe
4916	spoolsv.exe
4916	spoolsv.exe
1076	spoolsv.exe
1076	spoolsv.exe
4900	spoolsv.exe
4900	spoolsv.exe
3760	spoolsv.exe
3760	spoolsv.exe
4108	spoolsv.exe
4108	spoolsv.exe
4052	spoolsv.exe
4052	spoolsv.exe
4008	spoolsv.exe
4008	spoolsv.exe
2320	spoolsv.exe
2320	spoolsv.exe
764	spoolsv.exe
764	spoolsv.exe
5080	spoolsv.exe
5080	spoolsv.exe
4044	spoolsv.exe
4044	spoolsv.exe
4216	spoolsv.exe
4216	spoolsv.exe
3028	spoolsv.exe
3028	spoolsv.exe
464	spoolsv.exe
464	spoolsv.exe
3488	spoolsv.exe
3488	spoolsv.exe
5068	spoolsv.exe
5068	spoolsv.exe
1420	spoolsv.exe
1420	spoolsv.exe
4620	spoolsv.exe
4620	spoolsv.exe
4176	spoolsv.exe
4176	spoolsv.exe
1372	spoolsv.exe
1372	spoolsv.exe
1424	spoolsv.exe
1424	spoolsv.exe
4872	spoolsv.exe
4872	spoolsv.exe
4604	spoolsv.exe
4604	spoolsv.exe
5108	spoolsv.exe
5108	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 1700	5080	f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe	82
PID 5080 wrote to memory of 1700	5080	f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe	82
PID 5080 wrote to memory of 4116	5080	f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe	91
PID 5080 wrote to memory of 4116	5080	f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe	91
PID 5080 wrote to memory of 4116	5080	f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe	91
PID 5080 wrote to memory of 4116	5080	f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe	91
PID 5080 wrote to memory of 4116	5080	f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe	91
PID 4116 wrote to memory of 3920	4116	f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe	92
PID 4116 wrote to memory of 3920	4116	f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe	92
PID 4116 wrote to memory of 3920	4116	f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe	92
PID 3920 wrote to memory of 1200	3920	explorer.exe	95
PID 3920 wrote to memory of 1200	3920	explorer.exe	95
PID 3920 wrote to memory of 1200	3920	explorer.exe	95
PID 3920 wrote to memory of 1200	3920	explorer.exe	95
PID 3920 wrote to memory of 1200	3920	explorer.exe	95
PID 1200 wrote to memory of 2948	1200	explorer.exe	96
PID 1200 wrote to memory of 2948	1200	explorer.exe	96
PID 1200 wrote to memory of 2948	1200	explorer.exe	96
PID 1200 wrote to memory of 3264	1200	explorer.exe	97
PID 1200 wrote to memory of 3264	1200	explorer.exe	97
PID 1200 wrote to memory of 3264	1200	explorer.exe	97
PID 1200 wrote to memory of 2616	1200	explorer.exe	98
PID 1200 wrote to memory of 2616	1200	explorer.exe	98
PID 1200 wrote to memory of 2616	1200	explorer.exe	98
PID 1200 wrote to memory of 1572	1200	explorer.exe	99
PID 1200 wrote to memory of 1572	1200	explorer.exe	99
PID 1200 wrote to memory of 1572	1200	explorer.exe	99
PID 1200 wrote to memory of 1364	1200	explorer.exe	100
PID 1200 wrote to memory of 1364	1200	explorer.exe	100
PID 1200 wrote to memory of 1364	1200	explorer.exe	100
PID 1200 wrote to memory of 2792	1200	explorer.exe	101
PID 1200 wrote to memory of 2792	1200	explorer.exe	101
PID 1200 wrote to memory of 2792	1200	explorer.exe	101
PID 1200 wrote to memory of 452	1200	explorer.exe	102
PID 1200 wrote to memory of 452	1200	explorer.exe	102
PID 1200 wrote to memory of 452	1200	explorer.exe	102
PID 1200 wrote to memory of 1576	1200	explorer.exe	103
PID 1200 wrote to memory of 1576	1200	explorer.exe	103
PID 1200 wrote to memory of 1576	1200	explorer.exe	103
PID 1200 wrote to memory of 4492	1200	explorer.exe	104
PID 1200 wrote to memory of 4492	1200	explorer.exe	104
PID 1200 wrote to memory of 4492	1200	explorer.exe	104
PID 1200 wrote to memory of 3060	1200	explorer.exe	105
PID 1200 wrote to memory of 3060	1200	explorer.exe	105
PID 1200 wrote to memory of 3060	1200	explorer.exe	105
PID 1200 wrote to memory of 4676	1200	explorer.exe	106
PID 1200 wrote to memory of 4676	1200	explorer.exe	106
PID 1200 wrote to memory of 4676	1200	explorer.exe	106
PID 1200 wrote to memory of 2244	1200	explorer.exe	107
PID 1200 wrote to memory of 2244	1200	explorer.exe	107
PID 1200 wrote to memory of 2244	1200	explorer.exe	107
PID 1200 wrote to memory of 4888	1200	explorer.exe	108
PID 1200 wrote to memory of 4888	1200	explorer.exe	108
PID 1200 wrote to memory of 4888	1200	explorer.exe	108
PID 1200 wrote to memory of 3844	1200	explorer.exe	109
PID 1200 wrote to memory of 3844	1200	explorer.exe	109
PID 1200 wrote to memory of 3844	1200	explorer.exe	109
PID 1200 wrote to memory of 3624	1200	explorer.exe	110
PID 1200 wrote to memory of 3624	1200	explorer.exe	110
PID 1200 wrote to memory of 3624	1200	explorer.exe	110
PID 1200 wrote to memory of 1580	1200	explorer.exe	111
PID 1200 wrote to memory of 1580	1200	explorer.exe	111
PID 1200 wrote to memory of 1580	1200	explorer.exe	111
PID 1200 wrote to memory of 3048	1200	explorer.exe	112

C:\Users\Admin\AppData\Local\Temp\f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1700
- C:\Users\Admin\AppData\Local\Temp\f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f7d189a35f35f41f2cc955e8e07aac42_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4116
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3920
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2948
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1036
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5112
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3240
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3264
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2616
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:452
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1576
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4900
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4680
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3060
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2244
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4888
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3844
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:764
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2228
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3624
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1580
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3048
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3524
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4972
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3488
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3392
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2144
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2940
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4452
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4480
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4176
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1600
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1372
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3480
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4864
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4948
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4504
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4524
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1188
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1828
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4576
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1904
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4628
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:896
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2980
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3812
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4236
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4456
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2976
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3492
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1716
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1792
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3716
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:976
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1756
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2360
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6008
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:6060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4312
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5548
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5288
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2156
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
95e87acc663920d001fdb6d72a26c45f

SHA1
89163e9012983fd76c5a888c93215fba19af5d3f

SHA256
99c59cb9f3ce8146d34a4d119982c117ffed9e2041a4681fb132ed5d57416ac1

SHA512
72023f395c686ccadc2cb66f74b0e98825c4bc34d965dbece796e356c07b08523c9057422bb6ee6b04e8c25e44f371abbee69592d1c9eaa2612b6a282e50e6cf

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
df0e8855146f443736d9780779fc33f0

SHA1
4a7a7b2e5c757ea501d407ee5b332f93292eeba3

SHA256
aecff53b41d1ee2a331d58ffeaa0942464a421e68c83c53c58153979beb56334

SHA512
00732a1d1ccad96e63eca448518c59b40188f83c2925fdac23699e5e70d8e3a7bed7f34cd0e5f08393153ff6f3930a53a33f8d8fdaa534d7614bff984e639391

Download Submit
memory/452-1409-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/464-2977-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/764-2836-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/976-5176-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1036-2328-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1036-2523-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1076-2497-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1200-100-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1200-4616-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1200-808-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1364-1207-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1372-3424-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1420-3078-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1568-5309-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1572-1141-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1576-1485-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1580-2013-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1684-2323-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1708-2446-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1764-5186-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1792-4886-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1792-5031-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1916-2339-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1960-3454-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2144-4973-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2244-1771-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2320-2690-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2360-5477-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2484-2427-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2484-2423-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2528-3479-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2616-1075-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2616-2425-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2792-1288-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2940-2337-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2948-881-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2948-2330-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2980-3866-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2980-3970-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3028-2966-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3028-2968-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3048-2090-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3060-1567-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3240-3860-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3264-2340-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3264-1074-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3388-2236-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3488-3053-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3488-3258-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3492-4602-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3524-2167-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3564-4623-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3624-1896-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3640-4130-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3760-2638-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3844-1824-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3920-101-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3920-95-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4044-2855-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4052-2656-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4108-2646-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4116-84-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4116-29-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4116-30-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4116-52-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/4176-3096-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4176-3099-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4216-2866-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4452-2338-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4456-4294-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4480-2444-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4492-1486-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4524-3445-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4620-3086-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4676-1655-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4872-3292-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4888-1823-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4900-2626-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4916-2468-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4916-2466-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4972-2168-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5068-3068-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5080-27-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/5080-2847-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5080-0-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/5080-26-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5080-34-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5108-3309-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5256-5402-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5256-5407-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5288-5884-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5336-5418-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5364-5891-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5456-5902-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5508-5679-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5548-5669-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5828-5753-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5828-5748-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5896-5562-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5980-5759-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5980-5763-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6008-5646-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6008-5568-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6124-5581-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download