pony | 4f2d116f9c5163f07da23023edb95fba00a8bb072f380b05161090eed47ead6b

Analysis

max time kernel
143s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 09:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe
Size

2.2MB
MD5

fe4078db9a0ee879b7bdb0942ec073ce
SHA1

7eba4a7c0a3b94990c0e8dc9118844ec0b749594
SHA256

4f2d116f9c5163f07da23023edb95fba00a8bb072f380b05161090eed47ead6b
SHA512

8fddc8269c74e540aeebf7939e138139793482ef08518043a2e783b0e89abcccb49c90f0bb26458720cde7a8911ef885c1942a5fa6fd2be938b6b69ce1715edb
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZV:0UzeyQMS4DqodCnoe+iitjWww5

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe	fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe	fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1884	explorer.exe
216	explorer.exe
1044	spoolsv.exe
4484	spoolsv.exe
2300	spoolsv.exe
3260	spoolsv.exe
1336	spoolsv.exe
4424	spoolsv.exe
1204	spoolsv.exe
676	spoolsv.exe
904	spoolsv.exe
5092	spoolsv.exe
4380	spoolsv.exe
696	spoolsv.exe
3544	spoolsv.exe
3220	spoolsv.exe
4560	spoolsv.exe
2216	spoolsv.exe
3916	spoolsv.exe
4224	spoolsv.exe
4140	spoolsv.exe
3168	spoolsv.exe
2288	spoolsv.exe
1092	spoolsv.exe
2640	spoolsv.exe
3596	spoolsv.exe
4300	spoolsv.exe
388	spoolsv.exe
1316	spoolsv.exe
3868	spoolsv.exe
4220	spoolsv.exe
636	spoolsv.exe
1360	spoolsv.exe
64	spoolsv.exe
5068	spoolsv.exe
4024	spoolsv.exe
2200	spoolsv.exe
3152	explorer.exe
1504	spoolsv.exe
3844	spoolsv.exe
208	spoolsv.exe
1012	spoolsv.exe
2252	spoolsv.exe
860	spoolsv.exe
4132	spoolsv.exe
920	spoolsv.exe
2192	explorer.exe
1748	spoolsv.exe
2292	spoolsv.exe
1924	spoolsv.exe
4852	spoolsv.exe
4412	spoolsv.exe
4316	spoolsv.exe
4188	spoolsv.exe
5096	spoolsv.exe
2500	explorer.exe
4256	spoolsv.exe
4104	spoolsv.exe
3768	spoolsv.exe
1272	spoolsv.exe
1496	spoolsv.exe
3620	spoolsv.exe
640	explorer.exe
4828	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 55 IoCs

description	pid	Process	procid_target
PID 3312 set thread context of 3104	3312	fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe	91
PID 1884 set thread context of 216	1884	explorer.exe	95
PID 1044 set thread context of 2200	1044	spoolsv.exe	130
PID 4484 set thread context of 1504	4484	spoolsv.exe	132
PID 2300 set thread context of 3844	2300	spoolsv.exe	133
PID 3260 set thread context of 208	3260	spoolsv.exe	134
PID 1336 set thread context of 2252	1336	spoolsv.exe	136
PID 4424 set thread context of 860	4424	spoolsv.exe	137
PID 1204 set thread context of 4132	1204	spoolsv.exe	138
PID 676 set thread context of 920	676	spoolsv.exe	139
PID 904 set thread context of 1748	904	spoolsv.exe	141
PID 5092 set thread context of 2292	5092	spoolsv.exe	142
PID 4380 set thread context of 1924	4380	spoolsv.exe	143
PID 696 set thread context of 4852	696	spoolsv.exe	144
PID 3544 set thread context of 4316	3544	spoolsv.exe	146
PID 3220 set thread context of 4188	3220	spoolsv.exe	147
PID 4560 set thread context of 5096	4560	spoolsv.exe	148
PID 2216 set thread context of 4256	2216	spoolsv.exe	150
PID 3916 set thread context of 4104	3916	spoolsv.exe	151
PID 4224 set thread context of 3768	4224	spoolsv.exe	152
PID 4140 set thread context of 1496	4140	spoolsv.exe	154
PID 3168 set thread context of 3620	3168	spoolsv.exe	155
PID 2288 set thread context of 4828	2288	spoolsv.exe	157
PID 1092 set thread context of 1196	1092	spoolsv.exe	158
PID 2640 set thread context of 3532	2640	spoolsv.exe	159
PID 3596 set thread context of 2988	3596	spoolsv.exe	160
PID 4300 set thread context of 1960	4300	spoolsv.exe	162
PID 388 set thread context of 2000	388	spoolsv.exe	164
PID 1316 set thread context of 4264	1316	spoolsv.exe	165
PID 3868 set thread context of 3456	3868	spoolsv.exe	166
PID 4220 set thread context of 5080	4220	spoolsv.exe	167
PID 636 set thread context of 2064	636	spoolsv.exe	169
PID 1360 set thread context of 620	1360	spoolsv.exe	171
PID 64 set thread context of 3888	64	spoolsv.exe	172
PID 5068 set thread context of 1444	5068	spoolsv.exe	174
PID 4024 set thread context of 4108	4024	spoolsv.exe	180
PID 3152 set thread context of 1408	3152	explorer.exe	184
PID 1012 set thread context of 1076	1012	spoolsv.exe	188
PID 2192 set thread context of 1404	2192	explorer.exe	192
PID 4412 set thread context of 4228	4412	spoolsv.exe	195
PID 2500 set thread context of 4260	2500	explorer.exe	198
PID 1272 set thread context of 1364	1272	spoolsv.exe	202
PID 640 set thread context of 4420	640	explorer.exe	204
PID 3644 set thread context of 4416	3644	spoolsv.exe	207
PID 1604 set thread context of 4728	1604	explorer.exe	209
PID 5072 set thread context of 1004	5072	spoolsv.exe	212
PID 5052 set thread context of 2412	5052	explorer.exe	214
PID 868 set thread context of 2796	868	spoolsv.exe	215
PID 1916 set thread context of 4932	1916	explorer.exe	216
PID 4532 set thread context of 4368	4532	spoolsv.exe	217
PID 1908 set thread context of 2664	1908	spoolsv.exe	218
PID 3076 set thread context of 2352	3076	spoolsv.exe	219
PID 3944 set thread context of 4312	3944	spoolsv.exe	221
PID 1456 set thread context of 4016	1456	explorer.exe	223
PID 2792 set thread context of 2592	2792	spoolsv.exe	224

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3104	fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe
3104	fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
216	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3104	fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe
3104	fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
2200	spoolsv.exe
2200	spoolsv.exe
1504	spoolsv.exe
1504	spoolsv.exe
3844	spoolsv.exe
3844	spoolsv.exe
208	spoolsv.exe
208	spoolsv.exe
2252	spoolsv.exe
2252	spoolsv.exe
860	spoolsv.exe
860	spoolsv.exe
4132	spoolsv.exe
4132	spoolsv.exe
920	spoolsv.exe
920	spoolsv.exe
1748	spoolsv.exe
1748	spoolsv.exe
2292	spoolsv.exe
2292	spoolsv.exe
1924	spoolsv.exe
1924	spoolsv.exe
4852	spoolsv.exe
4852	spoolsv.exe
4316	spoolsv.exe
4316	spoolsv.exe
4188	spoolsv.exe
4188	spoolsv.exe
5096	spoolsv.exe
5096	spoolsv.exe
4256	spoolsv.exe
4256	spoolsv.exe
4104	spoolsv.exe
4104	spoolsv.exe
3768	spoolsv.exe
3768	spoolsv.exe
1496	spoolsv.exe
1496	spoolsv.exe
3620	spoolsv.exe
3620	spoolsv.exe
4828	spoolsv.exe
4828	spoolsv.exe
1196	spoolsv.exe
1196	spoolsv.exe
3532	spoolsv.exe
3532	spoolsv.exe
2988	spoolsv.exe
2988	spoolsv.exe
1960	spoolsv.exe
1960	spoolsv.exe
2000	spoolsv.exe
2000	spoolsv.exe
4264	spoolsv.exe
4264	spoolsv.exe
3456	spoolsv.exe
3456	spoolsv.exe
5080	spoolsv.exe
5080	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 4252	3312	fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe	82
PID 3312 wrote to memory of 4252	3312	fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe	82
PID 3312 wrote to memory of 3104	3312	fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe	91
PID 3312 wrote to memory of 3104	3312	fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe	91
PID 3312 wrote to memory of 3104	3312	fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe	91
PID 3312 wrote to memory of 3104	3312	fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe	91
PID 3312 wrote to memory of 3104	3312	fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe	91
PID 3104 wrote to memory of 1884	3104	fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe	92
PID 3104 wrote to memory of 1884	3104	fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe	92
PID 3104 wrote to memory of 1884	3104	fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe	92
PID 1884 wrote to memory of 216	1884	explorer.exe	95
PID 1884 wrote to memory of 216	1884	explorer.exe	95
PID 1884 wrote to memory of 216	1884	explorer.exe	95
PID 1884 wrote to memory of 216	1884	explorer.exe	95
PID 1884 wrote to memory of 216	1884	explorer.exe	95
PID 216 wrote to memory of 1044	216	explorer.exe	96
PID 216 wrote to memory of 1044	216	explorer.exe	96
PID 216 wrote to memory of 1044	216	explorer.exe	96
PID 216 wrote to memory of 4484	216	explorer.exe	97
PID 216 wrote to memory of 4484	216	explorer.exe	97
PID 216 wrote to memory of 4484	216	explorer.exe	97
PID 216 wrote to memory of 2300	216	explorer.exe	98
PID 216 wrote to memory of 2300	216	explorer.exe	98
PID 216 wrote to memory of 2300	216	explorer.exe	98
PID 216 wrote to memory of 3260	216	explorer.exe	99
PID 216 wrote to memory of 3260	216	explorer.exe	99
PID 216 wrote to memory of 3260	216	explorer.exe	99
PID 216 wrote to memory of 1336	216	explorer.exe	100
PID 216 wrote to memory of 1336	216	explorer.exe	100
PID 216 wrote to memory of 1336	216	explorer.exe	100
PID 216 wrote to memory of 4424	216	explorer.exe	101
PID 216 wrote to memory of 4424	216	explorer.exe	101
PID 216 wrote to memory of 4424	216	explorer.exe	101
PID 216 wrote to memory of 1204	216	explorer.exe	102
PID 216 wrote to memory of 1204	216	explorer.exe	102
PID 216 wrote to memory of 1204	216	explorer.exe	102
PID 216 wrote to memory of 676	216	explorer.exe	103
PID 216 wrote to memory of 676	216	explorer.exe	103
PID 216 wrote to memory of 676	216	explorer.exe	103
PID 216 wrote to memory of 904	216	explorer.exe	104
PID 216 wrote to memory of 904	216	explorer.exe	104
PID 216 wrote to memory of 904	216	explorer.exe	104
PID 216 wrote to memory of 5092	216	explorer.exe	105
PID 216 wrote to memory of 5092	216	explorer.exe	105
PID 216 wrote to memory of 5092	216	explorer.exe	105
PID 216 wrote to memory of 4380	216	explorer.exe	106
PID 216 wrote to memory of 4380	216	explorer.exe	106
PID 216 wrote to memory of 4380	216	explorer.exe	106
PID 216 wrote to memory of 696	216	explorer.exe	107
PID 216 wrote to memory of 696	216	explorer.exe	107
PID 216 wrote to memory of 696	216	explorer.exe	107
PID 216 wrote to memory of 3544	216	explorer.exe	108
PID 216 wrote to memory of 3544	216	explorer.exe	108
PID 216 wrote to memory of 3544	216	explorer.exe	108
PID 216 wrote to memory of 3220	216	explorer.exe	109
PID 216 wrote to memory of 3220	216	explorer.exe	109
PID 216 wrote to memory of 3220	216	explorer.exe	109
PID 216 wrote to memory of 4560	216	explorer.exe	110
PID 216 wrote to memory of 4560	216	explorer.exe	110
PID 216 wrote to memory of 4560	216	explorer.exe	110
PID 216 wrote to memory of 2216	216	explorer.exe	111
PID 216 wrote to memory of 2216	216	explorer.exe	111
PID 216 wrote to memory of 2216	216	explorer.exe	111
PID 216 wrote to memory of 3916	216	explorer.exe	112

C:\Users\Admin\AppData\Local\Temp\fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4252
- C:\Users\Admin\AppData\Local\Temp\fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fe4078db9a0ee879b7bdb0942ec073ce_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3104
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2200
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3152
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2300
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1336
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1204
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:920
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2192
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:696
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5096
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2500
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3916
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4224
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4140
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3168
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3620
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:640
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2288
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4300
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1960
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1604
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:636
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2064
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5052
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:64
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1444
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1916
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4024
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4108
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1456
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1076
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1892
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4412
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4228
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1272
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1364
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4416
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5072
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1004
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4532
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1908
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4312
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:888
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3468
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4048
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2856
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4996
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4784
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
164a8906a99009c5b21fd3fc4d653435

SHA1
5ff3f589a1555208dfa7481b7e7dad193bcfcc84

SHA256
623584e5665e4d34795e372f756fa6226ddc06d29b1eaef210e9523922b2a703

SHA512
78e46069174940d918bafbd9bda627aa541816a17c03278f92402a60013d884307ac08654df9034ab7c18cb710ba8463ef408838fbfdca6302f9002c504d27db

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
30ce65f420b8ee52646bd19fb43fc280

SHA1
3698a90a2f66b74cc41d7a9bb6566509a4df7c4c

SHA256
bcecdd1b9f4bbe80653b476d2ce3184acba0582d4c11205b63dcea6de47dd234

SHA512
e751e2a46dd0e92642e648ebaad4e8ab69d0208de200aa541556edb8767d838fff0718bdae163b16ba62c66d20cb549ebdabd1aebc4936fa43e7dc8359b9be48

Download Submit
memory/208-2317-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/208-2320-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/216-90-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/216-758-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/216-4791-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/620-3290-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/676-1378-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/696-1749-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/860-2398-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/860-2402-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/888-5765-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/888-5635-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/904-1459-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/920-2483-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1004-5296-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1040-6040-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1044-881-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1044-2285-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1076-4132-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1076-4234-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1092-2277-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1196-2952-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1196-2947-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1204-1375-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1336-1235-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1364-4870-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1364-4978-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1404-4346-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1408-3898-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1444-3472-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1496-2843-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1496-2848-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1504-2293-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1504-2297-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1748-2494-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1884-85-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1884-91-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1924-2514-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1960-3240-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1960-3125-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2000-3143-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2000-3148-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2064-3281-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2200-2460-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2200-2284-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2216-2001-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2252-2392-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2288-2276-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2292-2505-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2300-2307-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2300-1053-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2412-5307-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2592-5506-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2640-2292-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2664-5345-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2664-5340-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2796-5315-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2988-2967-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2988-2972-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3000-5979-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3104-50-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3104-49-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3104-79-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3104-77-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/3168-2199-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3220-1831-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3260-1174-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3312-46-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3312-47-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/3312-53-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3312-0-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/3456-3167-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3468-5788-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3532-2959-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3544-1750-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3596-2305-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3620-2928-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3620-3109-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3768-2738-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3844-2306-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3888-3299-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3916-2002-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4016-5497-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4104-2726-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4104-2731-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4108-3812-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4108-3683-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4132-2413-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4132-2409-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4140-2142-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4188-2630-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4224-2084-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4228-4509-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4256-2720-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4260-4641-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4264-3154-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4264-3159-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4312-5485-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4316-2623-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4316-2619-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4380-1607-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4416-5068-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4420-4881-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4424-1281-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4484-1052-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4484-2294-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4560-1884-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4728-5078-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4828-2936-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4828-2941-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4852-2544-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4932-5335-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4996-6071-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4996-5946-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5080-3232-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5092-1540-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5096-2708-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5096-2886-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download