pony | a96673eb2cb6d1d293d7b23f6bdfc24d95517e02e25163b2d3892ac7d7aa37a4

Analysis

max time kernel
140s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe
Size

2.2MB
MD5

fbe2a21d9ff7873e5636a79349279d11
SHA1

c0ad094b1b6fff5131575a2dce1752b1486b1a96
SHA256

a96673eb2cb6d1d293d7b23f6bdfc24d95517e02e25163b2d3892ac7d7aa37a4
SHA512

d599f33628d70c01004e9b40872993c3d4992d47547274a67c0e262eff0eaead711393e65094488c25f340327076289ad753180b9af30653584defe01f79a49a
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZq:0UzeyQMS4DqodCnoe+iitjWwwm

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe	fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe	fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1724	explorer.exe
1924	explorer.exe
1800	spoolsv.exe
2108	spoolsv.exe
3208	spoolsv.exe
1568	spoolsv.exe
920	spoolsv.exe
228	spoolsv.exe
4644	spoolsv.exe
3048	spoolsv.exe
2892	spoolsv.exe
2544	spoolsv.exe
2968	spoolsv.exe
2704	spoolsv.exe
2112	spoolsv.exe
4160	spoolsv.exe
3184	spoolsv.exe
1284	spoolsv.exe
4968	spoolsv.exe
4848	spoolsv.exe
3044	spoolsv.exe
2944	spoolsv.exe
4444	spoolsv.exe
216	spoolsv.exe
4840	spoolsv.exe
5076	spoolsv.exe
5008	spoolsv.exe
3300	spoolsv.exe
4472	spoolsv.exe
3928	spoolsv.exe
3708	spoolsv.exe
4348	spoolsv.exe
3544	spoolsv.exe
4748	explorer.exe
1276	spoolsv.exe
4148	spoolsv.exe
2404	spoolsv.exe
5112	spoolsv.exe
2064	spoolsv.exe
5092	explorer.exe
3020	spoolsv.exe
3200	spoolsv.exe
4824	spoolsv.exe
4052	spoolsv.exe
988	spoolsv.exe
5060	explorer.exe
2816	spoolsv.exe
4664	spoolsv.exe
1520	spoolsv.exe
2484	spoolsv.exe
3172	spoolsv.exe
4124	explorer.exe
3424	spoolsv.exe
4028	spoolsv.exe
2700	spoolsv.exe
4528	spoolsv.exe
4308	explorer.exe
2380	spoolsv.exe
3128	spoolsv.exe
4712	spoolsv.exe
1624	spoolsv.exe
3052	spoolsv.exe
2844	spoolsv.exe
4172	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 48 IoCs

description	pid	Process	procid_target
PID 4456 set thread context of 2548	4456	fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe	91
PID 1724 set thread context of 1924	1724	explorer.exe	95
PID 1800 set thread context of 3544	1800	spoolsv.exe	126
PID 2108 set thread context of 1276	2108	spoolsv.exe	128
PID 3208 set thread context of 4148	3208	spoolsv.exe	129
PID 1568 set thread context of 2404	1568	spoolsv.exe	130
PID 920 set thread context of 2064	920	spoolsv.exe	132
PID 228 set thread context of 3020	228	spoolsv.exe	134
PID 4644 set thread context of 3200	4644	spoolsv.exe	135
PID 3048 set thread context of 4052	3048	spoolsv.exe	137
PID 2892 set thread context of 988	2892	spoolsv.exe	138
PID 2544 set thread context of 2816	2544	spoolsv.exe	140
PID 2968 set thread context of 4664	2968	spoolsv.exe	141
PID 2704 set thread context of 2484	2704	spoolsv.exe	143
PID 2112 set thread context of 3172	2112	spoolsv.exe	144
PID 4160 set thread context of 3424	4160	spoolsv.exe	146
PID 3184 set thread context of 4028	3184	spoolsv.exe	147
PID 1284 set thread context of 4528	1284	spoolsv.exe	149
PID 4968 set thread context of 2380	4968	spoolsv.exe	151
PID 4848 set thread context of 3128	4848	spoolsv.exe	152
PID 3044 set thread context of 4712	3044	spoolsv.exe	153
PID 2944 set thread context of 3052	2944	spoolsv.exe	155
PID 4444 set thread context of 2844	4444	spoolsv.exe	156
PID 216 set thread context of 4556	216	spoolsv.exe	158
PID 4840 set thread context of 2760	4840	spoolsv.exe	159
PID 5076 set thread context of 392	5076	spoolsv.exe	161
PID 5008 set thread context of 540	5008	spoolsv.exe	163
PID 3300 set thread context of 5020	3300	spoolsv.exe	164
PID 4472 set thread context of 1900	4472	spoolsv.exe	165
PID 3928 set thread context of 4020	3928	spoolsv.exe	167
PID 3708 set thread context of 4504	3708	spoolsv.exe	169
PID 4748 set thread context of 2560	4748	explorer.exe	172
PID 4348 set thread context of 4660	4348	spoolsv.exe	173
PID 5112 set thread context of 668	5112	spoolsv.exe	177
PID 5092 set thread context of 1748	5092	explorer.exe	180
PID 4824 set thread context of 1620	4824	spoolsv.exe	183
PID 5060 set thread context of 4620	5060	explorer.exe	185
PID 1520 set thread context of 2552	1520	spoolsv.exe	188
PID 4124 set thread context of 2232	4124	explorer.exe	190
PID 2700 set thread context of 3716	2700	spoolsv.exe	193
PID 4308 set thread context of 2324	4308	explorer.exe	196
PID 1624 set thread context of 2008	1624	spoolsv.exe	198
PID 4172 set thread context of 1432	4172	explorer.exe	200
PID 864 set thread context of 4520	864	spoolsv.exe	203
PID 4268 set thread context of 1452	4268	explorer.exe	205
PID 4564 set thread context of 464	4564	spoolsv.exe	206
PID 2728 set thread context of 1376	2728	explorer.exe	207
PID 4404 set thread context of 2888	4404	spoolsv.exe	209

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2548	fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe
2548	fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1924	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2548	fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe
2548	fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
1924	explorer.exe
3544	spoolsv.exe
3544	spoolsv.exe
1276	spoolsv.exe
1276	spoolsv.exe
4148	spoolsv.exe
4148	spoolsv.exe
2404	spoolsv.exe
2404	spoolsv.exe
2064	spoolsv.exe
2064	spoolsv.exe
3020	spoolsv.exe
3020	spoolsv.exe
3200	spoolsv.exe
3200	spoolsv.exe
4052	spoolsv.exe
4052	spoolsv.exe
988	spoolsv.exe
988	spoolsv.exe
2816	spoolsv.exe
2816	spoolsv.exe
4664	spoolsv.exe
4664	spoolsv.exe
2484	spoolsv.exe
2484	spoolsv.exe
3172	spoolsv.exe
3172	spoolsv.exe
3424	spoolsv.exe
3424	spoolsv.exe
4028	spoolsv.exe
4028	spoolsv.exe
4528	spoolsv.exe
4528	spoolsv.exe
2380	spoolsv.exe
2380	spoolsv.exe
3128	spoolsv.exe
3128	spoolsv.exe
4712	spoolsv.exe
4712	spoolsv.exe
3052	spoolsv.exe
3052	spoolsv.exe
2844	spoolsv.exe
2844	spoolsv.exe
4556	spoolsv.exe
4556	spoolsv.exe
2760	spoolsv.exe
2760	spoolsv.exe
392	spoolsv.exe
392	spoolsv.exe
540	spoolsv.exe
540	spoolsv.exe
5020	spoolsv.exe
5020	spoolsv.exe
1900	spoolsv.exe
1900	spoolsv.exe
4020	spoolsv.exe
4020	spoolsv.exe
4504	spoolsv.exe
4504	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 5040	4456	fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe	82
PID 4456 wrote to memory of 5040	4456	fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe	82
PID 4456 wrote to memory of 2548	4456	fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe	91
PID 4456 wrote to memory of 2548	4456	fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe	91
PID 4456 wrote to memory of 2548	4456	fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe	91
PID 4456 wrote to memory of 2548	4456	fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe	91
PID 4456 wrote to memory of 2548	4456	fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe	91
PID 2548 wrote to memory of 1724	2548	fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe	92
PID 2548 wrote to memory of 1724	2548	fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe	92
PID 2548 wrote to memory of 1724	2548	fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe	92
PID 1724 wrote to memory of 1924	1724	explorer.exe	95
PID 1724 wrote to memory of 1924	1724	explorer.exe	95
PID 1724 wrote to memory of 1924	1724	explorer.exe	95
PID 1724 wrote to memory of 1924	1724	explorer.exe	95
PID 1724 wrote to memory of 1924	1724	explorer.exe	95
PID 1924 wrote to memory of 1800	1924	explorer.exe	96
PID 1924 wrote to memory of 1800	1924	explorer.exe	96
PID 1924 wrote to memory of 1800	1924	explorer.exe	96
PID 1924 wrote to memory of 2108	1924	explorer.exe	97
PID 1924 wrote to memory of 2108	1924	explorer.exe	97
PID 1924 wrote to memory of 2108	1924	explorer.exe	97
PID 1924 wrote to memory of 3208	1924	explorer.exe	98
PID 1924 wrote to memory of 3208	1924	explorer.exe	98
PID 1924 wrote to memory of 3208	1924	explorer.exe	98
PID 1924 wrote to memory of 1568	1924	explorer.exe	99
PID 1924 wrote to memory of 1568	1924	explorer.exe	99
PID 1924 wrote to memory of 1568	1924	explorer.exe	99
PID 1924 wrote to memory of 920	1924	explorer.exe	100
PID 1924 wrote to memory of 920	1924	explorer.exe	100
PID 1924 wrote to memory of 920	1924	explorer.exe	100
PID 1924 wrote to memory of 228	1924	explorer.exe	101
PID 1924 wrote to memory of 228	1924	explorer.exe	101
PID 1924 wrote to memory of 228	1924	explorer.exe	101
PID 1924 wrote to memory of 4644	1924	explorer.exe	102
PID 1924 wrote to memory of 4644	1924	explorer.exe	102
PID 1924 wrote to memory of 4644	1924	explorer.exe	102
PID 1924 wrote to memory of 3048	1924	explorer.exe	103
PID 1924 wrote to memory of 3048	1924	explorer.exe	103
PID 1924 wrote to memory of 3048	1924	explorer.exe	103
PID 1924 wrote to memory of 2892	1924	explorer.exe	104
PID 1924 wrote to memory of 2892	1924	explorer.exe	104
PID 1924 wrote to memory of 2892	1924	explorer.exe	104
PID 1924 wrote to memory of 2544	1924	explorer.exe	105
PID 1924 wrote to memory of 2544	1924	explorer.exe	105
PID 1924 wrote to memory of 2544	1924	explorer.exe	105
PID 1924 wrote to memory of 2968	1924	explorer.exe	106
PID 1924 wrote to memory of 2968	1924	explorer.exe	106
PID 1924 wrote to memory of 2968	1924	explorer.exe	106
PID 1924 wrote to memory of 2704	1924	explorer.exe	107
PID 1924 wrote to memory of 2704	1924	explorer.exe	107
PID 1924 wrote to memory of 2704	1924	explorer.exe	107
PID 1924 wrote to memory of 2112	1924	explorer.exe	108
PID 1924 wrote to memory of 2112	1924	explorer.exe	108
PID 1924 wrote to memory of 2112	1924	explorer.exe	108
PID 1924 wrote to memory of 4160	1924	explorer.exe	109
PID 1924 wrote to memory of 4160	1924	explorer.exe	109
PID 1924 wrote to memory of 4160	1924	explorer.exe	109
PID 1924 wrote to memory of 3184	1924	explorer.exe	110
PID 1924 wrote to memory of 3184	1924	explorer.exe	110
PID 1924 wrote to memory of 3184	1924	explorer.exe	110
PID 1924 wrote to memory of 1284	1924	explorer.exe	111
PID 1924 wrote to memory of 1284	1924	explorer.exe	111
PID 1924 wrote to memory of 1284	1924	explorer.exe	111
PID 1924 wrote to memory of 4968	1924	explorer.exe	112

C:\Users\Admin\AppData\Local\Temp\fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:5040
- C:\Users\Admin\AppData\Local\Temp\fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fbe2a21d9ff7873e5636a79349279d11_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2548
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1800
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3544
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4748
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2064
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5092
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3048
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2892
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:988
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5060
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2968
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2704
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3172
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4124
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2232
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4160
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3184
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1284
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4528
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4308
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4968
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4848
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2844
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4172
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:392
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4268
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3300
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4472
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4020
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2728
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4348
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4660
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4756
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:668
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3696
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4824
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1620
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1520
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2552
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2700
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3716
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1624
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2008
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2784
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:864
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4520
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4404
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2888
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:412
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4440
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1296
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3416
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
703e2abf238b8003e1d6388dc242ef1f

SHA1
4552ad218d69aed3db4aef3ab2628cf8c9e33892

SHA256
36785e85459078968a37c60e32d8b0eb309fd661ffd88bc0671c74a00de57447

SHA512
e33dc8d93bdf6f6e2b86703a16c603bb03fac82f1a2e9b268c02916a396f7ea2c07720c889c1db0ef9b60b8d63e77b08133f9c8d2bb5816a5ae0bbc34008cec2

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
54bf89fd8b71ecd11732aeb7a8076b11

SHA1
08ce1a80251030272fec8bc5cef0c548fb3d224a

SHA256
2e6c3738e7b90c0df9251b063e3b4be7ce8a0c668e67f0b4d5be59a2b945277f

SHA512
8913e7bf366cb4891a679b28cd3b57b693e82859d90e152c4978168e1d15cc7e96aceb7c6d657785f640a1e7127f2d407e615767bd8e629139dd081fa07a905a

Download Submit
memory/216-1967-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/228-1061-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/392-3137-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/392-2970-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/412-4810-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/464-4564-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/540-2990-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/540-2985-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/668-3673-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/668-3585-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/920-1060-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/988-2261-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/988-2397-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1276-1948-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1284-1742-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1376-4575-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1432-4415-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1568-994-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1568-1971-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1620-3734-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1724-96-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1724-90-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1748-3606-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1800-1939-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1800-719-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1840-5044-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1840-5046-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1924-3925-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1924-95-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1924-626-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2008-4364-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2064-2242-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2108-852-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2108-1950-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2112-1556-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2232-3943-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2324-4227-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2324-4222-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2380-2596-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2404-1970-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2404-1999-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2484-2352-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2544-1427-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2548-79-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2548-77-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/2548-30-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2548-29-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2552-4061-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2552-3931-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2560-3372-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2704-1489-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2816-2270-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2816-2273-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2844-2961-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2844-2811-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2888-4790-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2888-4691-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2892-1284-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2944-1941-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2968-1428-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3020-2083-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3020-2087-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3044-1937-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3048-1208-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3052-2716-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3052-2720-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3128-2609-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3172-2547-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3184-1690-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3200-2096-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3208-923-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3208-1962-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3228-5049-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3416-5026-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3424-2423-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3544-1938-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3544-2057-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3716-4269-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3716-4128-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4020-3144-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4020-3278-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4028-2432-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4052-2162-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4148-1959-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4160-1618-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4444-1953-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4456-26-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4456-27-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/4456-0-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/4456-34-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4504-3165-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4504-3161-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4520-4663-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4520-4547-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4528-2793-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4556-2823-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4556-2818-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4620-3806-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4644-1132-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4660-3485-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4664-2281-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4712-2618-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4848-1921-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4968-1859-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5020-2995-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5020-3000-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download