pony | 6e3c176cfbc6201175724514b0398c6fad0c69a94a5b772bc92cf0a15cf2279c

Analysis

max time kernel
147s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe
Size

2.2MB
MD5

fdf1faf1873e52a7c8d17912a5ef5530
SHA1

bcc0025853e60f1a09a00e6b689313692f716d32
SHA256

6e3c176cfbc6201175724514b0398c6fad0c69a94a5b772bc92cf0a15cf2279c
SHA512

0c3d912b2d355480566aa5dd7aeb5d0c14f200f84fc8d9a7e71a7d63db3fd7f19d7b5e3664c8787558c2ec55923938556c0e6e7a0aef4c059074023585b31692
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZK:0UzeyQMS4DqodCnoe+iitjWww+

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe	fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe	fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
3200	explorer.exe
4872	explorer.exe
844	spoolsv.exe
4840	spoolsv.exe
2348	spoolsv.exe
4888	spoolsv.exe
3292	spoolsv.exe
4956	spoolsv.exe
4852	spoolsv.exe
2364	spoolsv.exe
2360	spoolsv.exe
3636	spoolsv.exe
5044	spoolsv.exe
3608	spoolsv.exe
1680	spoolsv.exe
1036	spoolsv.exe
4704	spoolsv.exe
1944	spoolsv.exe
3236	spoolsv.exe
1428	spoolsv.exe
396	spoolsv.exe
4352	spoolsv.exe
4324	spoolsv.exe
1568	spoolsv.exe
2196	spoolsv.exe
1860	spoolsv.exe
4632	spoolsv.exe
2852	spoolsv.exe
4880	spoolsv.exe
5080	spoolsv.exe
2472	spoolsv.exe
1732	spoolsv.exe
2136	spoolsv.exe
60	spoolsv.exe
3324	spoolsv.exe
4240	spoolsv.exe
3520	spoolsv.exe
4960	spoolsv.exe
2840	spoolsv.exe
1964	explorer.exe
3184	spoolsv.exe
732	spoolsv.exe
1700	spoolsv.exe
2956	spoolsv.exe
4116	spoolsv.exe
2124	spoolsv.exe
2020	spoolsv.exe
2336	spoolsv.exe
4928	spoolsv.exe
2232	spoolsv.exe
2596	explorer.exe
3128	spoolsv.exe
2120	spoolsv.exe
1820	spoolsv.exe
3540	spoolsv.exe
948	spoolsv.exe
4728	spoolsv.exe
1284	spoolsv.exe
2116	spoolsv.exe
2388	spoolsv.exe
3144	explorer.exe
5056	spoolsv.exe
992	spoolsv.exe
1112	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 58 IoCs

description	pid	Process	procid_target
PID 2388 set thread context of 3872	2388	fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe	92
PID 3200 set thread context of 4872	3200	explorer.exe	96
PID 844 set thread context of 2840	844	spoolsv.exe	133
PID 4840 set thread context of 3184	4840	spoolsv.exe	135
PID 2348 set thread context of 732	2348	spoolsv.exe	136
PID 4888 set thread context of 2956	4888	spoolsv.exe	138
PID 3292 set thread context of 4116	3292	spoolsv.exe	139
PID 4956 set thread context of 2124	4956	spoolsv.exe	140
PID 4852 set thread context of 2020	4852	spoolsv.exe	141
PID 2364 set thread context of 2336	2364	spoolsv.exe	142
PID 2360 set thread context of 4928	2360	spoolsv.exe	143
PID 3636 set thread context of 2232	3636	spoolsv.exe	144
PID 5044 set thread context of 3128	5044	spoolsv.exe	146
PID 3608 set thread context of 1820	3608	spoolsv.exe	148
PID 1680 set thread context of 3540	1680	spoolsv.exe	149
PID 1036 set thread context of 948	1036	spoolsv.exe	150
PID 4704 set thread context of 4728	4704	spoolsv.exe	151
PID 1944 set thread context of 1284	1944	spoolsv.exe	152
PID 3236 set thread context of 2116	3236	spoolsv.exe	153
PID 1428 set thread context of 2388	1428	spoolsv.exe	154
PID 396 set thread context of 992	396	spoolsv.exe	157
PID 4352 set thread context of 1112	4352	spoolsv.exe	158
PID 4324 set thread context of 1108	4324	spoolsv.exe	159
PID 1568 set thread context of 4124	1568	spoolsv.exe	160
PID 2196 set thread context of 3256	2196	spoolsv.exe	161
PID 1860 set thread context of 3852	1860	spoolsv.exe	162
PID 4632 set thread context of 2264	4632	spoolsv.exe	163
PID 2852 set thread context of 2740	2852	spoolsv.exe	165
PID 4880 set thread context of 1472	4880	spoolsv.exe	167
PID 5080 set thread context of 4260	5080	spoolsv.exe	168
PID 2472 set thread context of 4616	2472	spoolsv.exe	169
PID 1732 set thread context of 3476	1732	spoolsv.exe	170
PID 2136 set thread context of 1468	2136	spoolsv.exe	171
PID 60 set thread context of 4708	60	spoolsv.exe	172
PID 3324 set thread context of 1512	3324	spoolsv.exe	173
PID 4240 set thread context of 1040	4240	spoolsv.exe	174
PID 3520 set thread context of 2168	3520	spoolsv.exe	177
PID 4960 set thread context of 1612	4960	spoolsv.exe	181
PID 1964 set thread context of 2692	1964	explorer.exe	186
PID 1700 set thread context of 2640	1700	spoolsv.exe	188
PID 2596 set thread context of 1984	2596	explorer.exe	194
PID 2120 set thread context of 1356	2120	spoolsv.exe	196
PID 3144 set thread context of 1532	3144	explorer.exe	203
PID 5056 set thread context of 2592	5056	spoolsv.exe	206
PID 4760 set thread context of 5268	4760	explorer.exe	214
PID 4064 set thread context of 5348	4064	spoolsv.exe	215
PID 2736 set thread context of 5464	2736	spoolsv.exe	217
PID 4924 set thread context of 5500	4924	explorer.exe	218
PID 1596 set thread context of 5840	1596	spoolsv.exe	220
PID 216 set thread context of 5908	216	spoolsv.exe	221
PID 3568 set thread context of 708	3568	spoolsv.exe	223
PID 3312 set thread context of 5468	3312	explorer.exe	225
PID 1280 set thread context of 3476	1280	spoolsv.exe	226
PID 4036 set thread context of 6068	4036	spoolsv.exe	228
PID 2932 set thread context of 1616	2932	spoolsv.exe	232
PID 472 set thread context of 5668	472	spoolsv.exe	234
PID 3920 set thread context of 5648	3920	explorer.exe	235
PID 2220 set thread context of 5832	2220	spoolsv.exe	236

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3872	fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe
3872	fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4872	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3872	fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe
3872	fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
4872	explorer.exe
2840	spoolsv.exe
2840	spoolsv.exe
3184	spoolsv.exe
3184	spoolsv.exe
732	spoolsv.exe
732	spoolsv.exe
2956	spoolsv.exe
2956	spoolsv.exe
4116	spoolsv.exe
4116	spoolsv.exe
2124	spoolsv.exe
2124	spoolsv.exe
2020	spoolsv.exe
2020	spoolsv.exe
2336	spoolsv.exe
2336	spoolsv.exe
4928	spoolsv.exe
4928	spoolsv.exe
2232	spoolsv.exe
2232	spoolsv.exe
3128	spoolsv.exe
3128	spoolsv.exe
1820	spoolsv.exe
1820	spoolsv.exe
3540	spoolsv.exe
3540	spoolsv.exe
948	spoolsv.exe
948	spoolsv.exe
4728	spoolsv.exe
4728	spoolsv.exe
1284	spoolsv.exe
1284	spoolsv.exe
2116	spoolsv.exe
2116	spoolsv.exe
2388	spoolsv.exe
2388	spoolsv.exe
992	spoolsv.exe
992	spoolsv.exe
1112	spoolsv.exe
1112	spoolsv.exe
1108	spoolsv.exe
1108	spoolsv.exe
4124	spoolsv.exe
4124	spoolsv.exe
3256	spoolsv.exe
3256	spoolsv.exe
3852	spoolsv.exe
3852	spoolsv.exe
2264	spoolsv.exe
2264	spoolsv.exe
2740	spoolsv.exe
2740	spoolsv.exe
1472	spoolsv.exe
1472	spoolsv.exe
4260	spoolsv.exe
4260	spoolsv.exe
4616	spoolsv.exe
4616	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 1276	2388	fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe	82
PID 2388 wrote to memory of 1276	2388	fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe	82
PID 2388 wrote to memory of 3872	2388	fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe	92
PID 2388 wrote to memory of 3872	2388	fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe	92
PID 2388 wrote to memory of 3872	2388	fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe	92
PID 2388 wrote to memory of 3872	2388	fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe	92
PID 2388 wrote to memory of 3872	2388	fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe	92
PID 3872 wrote to memory of 3200	3872	fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe	93
PID 3872 wrote to memory of 3200	3872	fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe	93
PID 3872 wrote to memory of 3200	3872	fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe	93
PID 3200 wrote to memory of 4872	3200	explorer.exe	96
PID 3200 wrote to memory of 4872	3200	explorer.exe	96
PID 3200 wrote to memory of 4872	3200	explorer.exe	96
PID 3200 wrote to memory of 4872	3200	explorer.exe	96
PID 3200 wrote to memory of 4872	3200	explorer.exe	96
PID 4872 wrote to memory of 844	4872	explorer.exe	97
PID 4872 wrote to memory of 844	4872	explorer.exe	97
PID 4872 wrote to memory of 844	4872	explorer.exe	97
PID 4872 wrote to memory of 4840	4872	explorer.exe	98
PID 4872 wrote to memory of 4840	4872	explorer.exe	98
PID 4872 wrote to memory of 4840	4872	explorer.exe	98
PID 4872 wrote to memory of 2348	4872	explorer.exe	99
PID 4872 wrote to memory of 2348	4872	explorer.exe	99
PID 4872 wrote to memory of 2348	4872	explorer.exe	99
PID 4872 wrote to memory of 4888	4872	explorer.exe	100
PID 4872 wrote to memory of 4888	4872	explorer.exe	100
PID 4872 wrote to memory of 4888	4872	explorer.exe	100
PID 4872 wrote to memory of 3292	4872	explorer.exe	101
PID 4872 wrote to memory of 3292	4872	explorer.exe	101
PID 4872 wrote to memory of 3292	4872	explorer.exe	101
PID 4872 wrote to memory of 4956	4872	explorer.exe	102
PID 4872 wrote to memory of 4956	4872	explorer.exe	102
PID 4872 wrote to memory of 4956	4872	explorer.exe	102
PID 4872 wrote to memory of 4852	4872	explorer.exe	103
PID 4872 wrote to memory of 4852	4872	explorer.exe	103
PID 4872 wrote to memory of 4852	4872	explorer.exe	103
PID 4872 wrote to memory of 2364	4872	explorer.exe	104
PID 4872 wrote to memory of 2364	4872	explorer.exe	104
PID 4872 wrote to memory of 2364	4872	explorer.exe	104
PID 4872 wrote to memory of 2360	4872	explorer.exe	105
PID 4872 wrote to memory of 2360	4872	explorer.exe	105
PID 4872 wrote to memory of 2360	4872	explorer.exe	105
PID 4872 wrote to memory of 3636	4872	explorer.exe	106
PID 4872 wrote to memory of 3636	4872	explorer.exe	106
PID 4872 wrote to memory of 3636	4872	explorer.exe	106
PID 4872 wrote to memory of 5044	4872	explorer.exe	107
PID 4872 wrote to memory of 5044	4872	explorer.exe	107
PID 4872 wrote to memory of 5044	4872	explorer.exe	107
PID 4872 wrote to memory of 3608	4872	explorer.exe	108
PID 4872 wrote to memory of 3608	4872	explorer.exe	108
PID 4872 wrote to memory of 3608	4872	explorer.exe	108
PID 4872 wrote to memory of 1680	4872	explorer.exe	109
PID 4872 wrote to memory of 1680	4872	explorer.exe	109
PID 4872 wrote to memory of 1680	4872	explorer.exe	109
PID 4872 wrote to memory of 1036	4872	explorer.exe	110
PID 4872 wrote to memory of 1036	4872	explorer.exe	110
PID 4872 wrote to memory of 1036	4872	explorer.exe	110
PID 4872 wrote to memory of 4704	4872	explorer.exe	111
PID 4872 wrote to memory of 4704	4872	explorer.exe	111
PID 4872 wrote to memory of 4704	4872	explorer.exe	111
PID 4872 wrote to memory of 1944	4872	explorer.exe	112
PID 4872 wrote to memory of 1944	4872	explorer.exe	112
PID 4872 wrote to memory of 1944	4872	explorer.exe	112
PID 4872 wrote to memory of 3236	4872	explorer.exe	113

C:\Users\Admin\AppData\Local\Temp\fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1276
- C:\Users\Admin\AppData\Local\Temp\fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fdf1faf1873e52a7c8d17912a5ef5530_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3872
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:844
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2840
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1964
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2348
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4888
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4852
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3636
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2232
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2596
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1680
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4704
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3236
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1428
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2388
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3144
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4352
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4324
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4632
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2264
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4760
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5268
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2852
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4880
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2472
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2136
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:60
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3324
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4240
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1040
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4924
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3520
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4960
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1612
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:3312
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1700
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2640
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3920
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1356
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2592
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2736
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:708
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1280
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6068
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2932
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1616
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:472
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5244
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1876
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1176
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
e9199ff267ff70b472e66bd304f933f9

SHA1
c7f1a9f6f50db3c805da7124fdf0011572c64031

SHA256
f77931ab4ae3991ab6d84d38e965280d037b981dd1c213ee7e75219451962222

SHA512
99c0e242440fa3456fcdab1ad5ba7e35229af5abf6706176ce57ed91836d898be3eb2e2f0bdec592da44d7e6df576fb5ebd16a050d5a94f9cb32d651cfd9e9d6

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
82b10a23f7dc7783a54cee0e2a06b45c

SHA1
c4bed7f5bb1c314cd4d20f31068c9ffc3d4be9a0

SHA256
4b728758fdff7ded2269bf56cac9839f9b09a6843235786cac94281eed40c09a

SHA512
6c72b6f87052f14213c902a2549862410fdab1c5e5f9c98abc576d9cf996c5c9d13661d793c8e53c9d5d6c60b8350eedcaeeb1e7ac91bc589c4a04c5297fe45f

Download Submit
memory/396-2201-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/708-5848-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/708-5733-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/732-2460-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/844-986-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/844-2441-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/992-2996-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1036-1896-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1040-3497-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1040-3414-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1108-3015-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1108-3018-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1112-3004-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1112-3007-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1284-2794-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1356-4598-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1428-2133-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1532-4918-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1568-2422-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1612-3793-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1616-6037-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1616-6124-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1680-1895-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1820-2756-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1860-2440-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1944-2025-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1984-4380-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2020-2571-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2116-2814-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2168-3445-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2196-2434-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2232-2869-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2232-2667-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2264-3309-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2264-3120-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2336-2584-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2348-2462-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2348-1163-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2360-1579-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2364-1513-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2388-2902-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2388-54-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2388-0-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/2388-46-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2388-47-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/2592-5132-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2640-4145-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2640-4040-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2692-3952-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2840-2649-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2840-2442-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2852-2459-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2956-2541-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3128-2676-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3184-2450-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3200-105-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3200-111-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3236-2026-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3292-1310-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3476-3247-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3476-5765-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3540-2767-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3608-1783-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3636-1580-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3872-50-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3872-49-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3872-94-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3872-92-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/4116-2552-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4124-3025-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4260-3230-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4324-2284-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4352-2283-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4616-3241-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4616-3237-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4632-2449-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4704-1973-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4708-3267-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4840-1052-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4840-2452-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4852-1422-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4872-865-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4872-110-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4872-4461-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4888-1239-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4928-2595-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4956-1311-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5044-1696-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5244-6200-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5268-5481-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5272-6208-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5272-6213-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5348-5488-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5348-5630-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5464-5500-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5468-5755-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5500-5511-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5832-6122-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5840-5574-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5840-5576-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5908-5584-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6068-5953-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download