3f438081d66d742339cb61c39a8ca4f07f844287e8ab2ccee9eea8af302570dc

Analysis

max time kernel
150s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 05:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe
Size

118KB
MD5

ba8413bd7cde42eb7e6c61144cb97ed3
SHA1

a94ae31338fbfb1b8f09a248ef1d718f89e61a70
SHA256

3f438081d66d742339cb61c39a8ca4f07f844287e8ab2ccee9eea8af302570dc
SHA512

3fb802765947d9ad0af60de54778f42a739b45c380f768cdd80acd1b2259103fbcd3a15641aec592198f52efd6315eb9b2cbd7d6350331e2977b7dafccd76e67
SSDEEP

3072:1vfb3O8b1iyxTophCbFkgq3/OsclajLjpW:1vD3O85/hScbFU/Og

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\userinit.exe"	userinit.exe

Executes dropped EXE 64 IoCs

pid	Process
3684	userinit.exe
3224	system.exe
4648	system.exe
1988	system.exe
3020	system.exe
2892	system.exe
2656	system.exe
2136	system.exe
3172	system.exe
4020	system.exe
3580	system.exe
3984	system.exe
1556	system.exe
4764	system.exe
3192	system.exe
3564	system.exe
3876	system.exe
2296	system.exe
3448	system.exe
3556	system.exe
4496	system.exe
3816	system.exe
2324	system.exe
3520	system.exe
1272	system.exe
3056	system.exe
2704	system.exe
3224	system.exe
2724	system.exe
1960	system.exe
4592	system.exe
3048	system.exe
4804	system.exe
3248	system.exe
4264	system.exe
4728	system.exe
744	system.exe
1556	system.exe
2196	system.exe
2832	system.exe
4300	system.exe
4792	system.exe
1172	system.exe
4156	system.exe
4364	system.exe
4392	system.exe
3588	system.exe
3816	system.exe
2324	system.exe
4932	system.exe
4808	system.exe
3056	system.exe
3992	system.exe
3096	system.exe
2876	system.exe
3184	system.exe
5060	system.exe
1060	system.exe
2468	system.exe
1652	system.exe
3272	system.exe
1748	system.exe
5016	system.exe
3744	system.exe

Loads dropped DLL 2 IoCs

pid	Process
3384	Regsvr32.exe
3684	userinit.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\MSWINSCK.OCX	userinit.exe
File created	C:\Windows\SysWOW64\system.exe	userinit.exe
File opened for modification	C:\Windows\SysWOW64\system.exe	userinit.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\userinit.exe	ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe
File opened for modification	C:\Windows\userinit.exe	ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe
File created	C:\Windows\kdcoms.dll	userinit.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	Regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32	Regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX, 1"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0"	Regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3520	ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe
3520	ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe
3684	userinit.exe
3684	userinit.exe
3684	userinit.exe
3684	userinit.exe
3224	system.exe
3224	system.exe
3684	userinit.exe
3684	userinit.exe
4648	system.exe
4648	system.exe
3684	userinit.exe
3684	userinit.exe
1988	system.exe
1988	system.exe
3684	userinit.exe
3684	userinit.exe
3020	system.exe
3020	system.exe
3684	userinit.exe
3684	userinit.exe
2892	system.exe
2892	system.exe
3684	userinit.exe
3684	userinit.exe
2656	system.exe
2656	system.exe
3684	userinit.exe
3684	userinit.exe
2136	system.exe
2136	system.exe
3684	userinit.exe
3684	userinit.exe
3172	system.exe
3172	system.exe
3684	userinit.exe
3684	userinit.exe
4020	system.exe
4020	system.exe
3684	userinit.exe
3684	userinit.exe
3580	system.exe
3580	system.exe
3684	userinit.exe
3684	userinit.exe
3984	system.exe
3984	system.exe
3684	userinit.exe
3684	userinit.exe
1556	system.exe
1556	system.exe
3684	userinit.exe
3684	userinit.exe
4764	system.exe
4764	system.exe
3684	userinit.exe
3684	userinit.exe
3192	system.exe
3192	system.exe
3684	userinit.exe
3684	userinit.exe
3564	system.exe
3564	system.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3684	userinit.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3520	ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe
3520	ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe
3684	userinit.exe
3684	userinit.exe
3224	system.exe
3224	system.exe
4648	system.exe
4648	system.exe
1988	system.exe
1988	system.exe
3020	system.exe
3020	system.exe
2892	system.exe
2892	system.exe
2656	system.exe
2656	system.exe
2136	system.exe
2136	system.exe
3172	system.exe
3172	system.exe
4020	system.exe
4020	system.exe
3580	system.exe
3580	system.exe
3984	system.exe
3984	system.exe
1556	system.exe
1556	system.exe
4764	system.exe
4764	system.exe
3192	system.exe
3192	system.exe
3564	system.exe
3564	system.exe
3876	system.exe
3876	system.exe
2296	system.exe
2296	system.exe
3448	system.exe
3448	system.exe
3556	system.exe
3556	system.exe
4496	system.exe
4496	system.exe
3816	system.exe
3816	system.exe
2324	system.exe
2324	system.exe
3520	system.exe
3520	system.exe
1272	system.exe
1272	system.exe
3056	system.exe
3056	system.exe
2704	system.exe
2704	system.exe
3224	system.exe
3224	system.exe
2724	system.exe
2724	system.exe
1960	system.exe
1960	system.exe
4592	system.exe
4592	system.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 3684	3520	ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe	84
PID 3520 wrote to memory of 3684	3520	ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe	84
PID 3520 wrote to memory of 3684	3520	ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe	84
PID 3684 wrote to memory of 3384	3684	userinit.exe	85
PID 3684 wrote to memory of 3384	3684	userinit.exe	85
PID 3684 wrote to memory of 3384	3684	userinit.exe	85
PID 3684 wrote to memory of 3224	3684	userinit.exe	89
PID 3684 wrote to memory of 3224	3684	userinit.exe	89
PID 3684 wrote to memory of 3224	3684	userinit.exe	89
PID 3684 wrote to memory of 4648	3684	userinit.exe	92
PID 3684 wrote to memory of 4648	3684	userinit.exe	92
PID 3684 wrote to memory of 4648	3684	userinit.exe	92
PID 3684 wrote to memory of 1988	3684	userinit.exe	94
PID 3684 wrote to memory of 1988	3684	userinit.exe	94
PID 3684 wrote to memory of 1988	3684	userinit.exe	94
PID 3684 wrote to memory of 3020	3684	userinit.exe	96
PID 3684 wrote to memory of 3020	3684	userinit.exe	96
PID 3684 wrote to memory of 3020	3684	userinit.exe	96
PID 3684 wrote to memory of 2892	3684	userinit.exe	97
PID 3684 wrote to memory of 2892	3684	userinit.exe	97
PID 3684 wrote to memory of 2892	3684	userinit.exe	97
PID 3684 wrote to memory of 2656	3684	userinit.exe	99
PID 3684 wrote to memory of 2656	3684	userinit.exe	99
PID 3684 wrote to memory of 2656	3684	userinit.exe	99
PID 3684 wrote to memory of 2136	3684	userinit.exe	100
PID 3684 wrote to memory of 2136	3684	userinit.exe	100
PID 3684 wrote to memory of 2136	3684	userinit.exe	100
PID 3684 wrote to memory of 3172	3684	userinit.exe	101
PID 3684 wrote to memory of 3172	3684	userinit.exe	101
PID 3684 wrote to memory of 3172	3684	userinit.exe	101
PID 3684 wrote to memory of 4020	3684	userinit.exe	104
PID 3684 wrote to memory of 4020	3684	userinit.exe	104
PID 3684 wrote to memory of 4020	3684	userinit.exe	104
PID 3684 wrote to memory of 3580	3684	userinit.exe	105
PID 3684 wrote to memory of 3580	3684	userinit.exe	105
PID 3684 wrote to memory of 3580	3684	userinit.exe	105
PID 3684 wrote to memory of 3984	3684	userinit.exe	106
PID 3684 wrote to memory of 3984	3684	userinit.exe	106
PID 3684 wrote to memory of 3984	3684	userinit.exe	106
PID 3684 wrote to memory of 1556	3684	userinit.exe	107
PID 3684 wrote to memory of 1556	3684	userinit.exe	107
PID 3684 wrote to memory of 1556	3684	userinit.exe	107
PID 3684 wrote to memory of 4764	3684	userinit.exe	108
PID 3684 wrote to memory of 4764	3684	userinit.exe	108
PID 3684 wrote to memory of 4764	3684	userinit.exe	108
PID 3684 wrote to memory of 3192	3684	userinit.exe	109
PID 3684 wrote to memory of 3192	3684	userinit.exe	109
PID 3684 wrote to memory of 3192	3684	userinit.exe	109
PID 3684 wrote to memory of 3564	3684	userinit.exe	110
PID 3684 wrote to memory of 3564	3684	userinit.exe	110
PID 3684 wrote to memory of 3564	3684	userinit.exe	110
PID 3684 wrote to memory of 3876	3684	userinit.exe	111
PID 3684 wrote to memory of 3876	3684	userinit.exe	111
PID 3684 wrote to memory of 3876	3684	userinit.exe	111
PID 3684 wrote to memory of 2296	3684	userinit.exe	112
PID 3684 wrote to memory of 2296	3684	userinit.exe	112
PID 3684 wrote to memory of 2296	3684	userinit.exe	112
PID 3684 wrote to memory of 3448	3684	userinit.exe	113
PID 3684 wrote to memory of 3448	3684	userinit.exe	113
PID 3684 wrote to memory of 3448	3684	userinit.exe	113
PID 3684 wrote to memory of 3556	3684	userinit.exe	114
PID 3684 wrote to memory of 3556	3684	userinit.exe	114
PID 3684 wrote to memory of 3556	3684	userinit.exe	114
PID 3684 wrote to memory of 4496	3684	userinit.exe	115

C:\Users\Admin\AppData\Local\Temp\ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ba8413bd7cde42eb7e6c61144cb97ed3_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\userinit.exe
  C:\Windows\userinit.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\SysWOW64\Regsvr32.exe
    Regsvr32 C:\Windows\system32\MSWINSCK.OCX /s
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:3384
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3224
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4648
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1988
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3020
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2892
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2656
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2136
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3172
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4020
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3580
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3984
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1556
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4764
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3192
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3564
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3876
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2296
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3448
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3556
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4496
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3816
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2324
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3520
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1272
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3056
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2704
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3224
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2724
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1960
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4592
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:3048
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4804
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:3248
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4264
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4728
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:744
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:1556
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2196
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2832
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4300
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4792
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1172
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4156
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4364
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4392
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3588
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:3816
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2324
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:4932
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4808
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3056
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3992
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3096
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:2876
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:3184
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:5060
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:1060
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2468
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:1652
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:3272
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:1748
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    PID:5016
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3744
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1948
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1556
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2268
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3456
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4472
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4924
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:768
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2492
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2296
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4348
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4356
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4024
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1204
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2420
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:956
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2096
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4744
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:464
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2108
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2876
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4132
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:5060
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3524
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:664
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2636
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4652
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2656
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3500
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1932
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2732
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4868
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:864
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2492
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1684
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4392
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3636
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4024
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1004
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4400
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5068
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4932
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1628
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5080
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3624
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3096
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4888
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2976
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2344
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3712
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:1408
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3484
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4428
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4488
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3160
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3912
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:212
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4208
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2552
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2084
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2476
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3264
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3652
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4364
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4812
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4228
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1028
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2404
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3852
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:4600
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3528
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2704
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3040
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5080
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:2108
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3096
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    PID:3968
- - C:\Windows\SysWOW64\system.exe
    C:\Windows\system32\system.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\MSWINSCK.OCX

Filesize
105KB

MD5
9484c04258830aa3c2f2a70eb041414c

SHA1
b242a4fb0e9dcf14cb51dc36027baff9a79cb823

SHA256
bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5

SHA512
9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0

Download Submit
C:\Windows\userinit.exe

Filesize
118KB

MD5
ba8413bd7cde42eb7e6c61144cb97ed3

SHA1
a94ae31338fbfb1b8f09a248ef1d718f89e61a70

SHA256
3f438081d66d742339cb61c39a8ca4f07f844287e8ab2ccee9eea8af302570dc

SHA512
3fb802765947d9ad0af60de54778f42a739b45c380f768cdd80acd1b2259103fbcd3a15641aec592198f52efd6315eb9b2cbd7d6350331e2977b7dafccd76e67

Download Submit
memory/212-629-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/464-444-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/664-474-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/744-212-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/768-386-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/864-513-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/956-429-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1028-682-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1172-243-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1272-148-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1408-600-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1556-360-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1556-217-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1556-83-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1556-87-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1628-560-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1652-330-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1684-523-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1748-340-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1932-498-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1948-355-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1960-174-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1988-39-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2084-643-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2096-434-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2108-449-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2136-60-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2196-223-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2268-365-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2296-112-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2296-396-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2324-424-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2324-274-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2344-589-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2404-687-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2476-649-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2492-518-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2492-391-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2552-638-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2636-479-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2656-489-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2656-55-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2704-706-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2704-158-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2724-168-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2832-228-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2876-304-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2876-454-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2892-50-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2976-584-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3020-45-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3028-663-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3048-186-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3056-153-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3056-289-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3096-299-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3160-620-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3172-65-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3184-309-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3192-97-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3224-163-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3224-28-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3248-196-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3272-335-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3448-117-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3456-371-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3484-605-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3520-18-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3520-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/3520-143-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3520-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3556-123-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3560-733-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3564-102-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3580-76-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3624-570-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3636-532-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3652-658-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3684-71-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3684-118-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3684-40-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/3712-594-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3744-350-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3816-133-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3816-268-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3876-107-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3968-728-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3984-81-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4020-70-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4024-410-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4024-537-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4132-459-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4156-248-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4264-202-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4264-198-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4300-233-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4348-401-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4364-253-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4364-668-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4392-258-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4428-610-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4472-376-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4488-615-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4496-128-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4592-181-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4592-176-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4600-697-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4648-34-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4648-30-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/4652-484-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4728-207-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4744-439-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4764-92-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4792-238-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4804-191-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4808-284-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4812-673-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4868-508-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4888-579-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4924-381-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4932-279-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4932-555-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/5016-345-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/5060-314-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/5060-465-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/5080-715-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/5080-565-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download