pony | 0ba292ffe1c18d26f14cdccf7674f8c7d61de15efda3546f8e1968f71a0ff5cb

Analysis

max time kernel
126s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2024 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe
Size

2.2MB
MD5

c12faa86d1a1ea88b51123f5f7be7802
SHA1

77550496b669d6c1d939e7d77a4019d28684f4a7
SHA256

0ba292ffe1c18d26f14cdccf7674f8c7d61de15efda3546f8e1968f71a0ff5cb
SHA512

559ea3c96c405520576e9e9b57b11b37cd535a828183bfb8fa7c1b5ca1fb048c158de653f3dc32f462f28dede5ef10b8a515959e849da69f2785e9bdb4abc355
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZQ:0UzeyQMS4DqodCnoe+iitjWwwM

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe	c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe	c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
212	explorer.exe
1812	explorer.exe
3536	spoolsv.exe
4084	spoolsv.exe
2116	spoolsv.exe
5036	spoolsv.exe
220	spoolsv.exe
4092	spoolsv.exe
4444	spoolsv.exe
5068	spoolsv.exe
4848	spoolsv.exe
5052	spoolsv.exe
5064	spoolsv.exe
3828	spoolsv.exe
4008	spoolsv.exe
1204	spoolsv.exe
1444	spoolsv.exe
4916	spoolsv.exe
3208	spoolsv.exe
4920	spoolsv.exe
1492	spoolsv.exe
3304	spoolsv.exe
3636	spoolsv.exe
4336	spoolsv.exe
3176	spoolsv.exe
3488	spoolsv.exe
4996	spoolsv.exe
508	spoolsv.exe
636	spoolsv.exe
1976	spoolsv.exe
5100	spoolsv.exe
4716	spoolsv.exe
1848	spoolsv.exe
3404	spoolsv.exe
384	spoolsv.exe
3696	spoolsv.exe
4028	spoolsv.exe
4556	explorer.exe
4700	spoolsv.exe
1332	spoolsv.exe
396	spoolsv.exe
4576	spoolsv.exe
4812	spoolsv.exe
1472	spoolsv.exe
3248	spoolsv.exe
3680	spoolsv.exe
876	spoolsv.exe
1912	explorer.exe
1228	spoolsv.exe
4512	spoolsv.exe
1276	spoolsv.exe
4596	spoolsv.exe
4852	spoolsv.exe
1728	spoolsv.exe
1748	spoolsv.exe
840	explorer.exe
4196	spoolsv.exe
1244	spoolsv.exe
4860	spoolsv.exe
1876	spoolsv.exe
2764	spoolsv.exe
2984	spoolsv.exe
4788	spoolsv.exe
3084	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 42 IoCs

description	pid	Process	procid_target
PID 1728 set thread context of 4592	1728	c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe	97
PID 212 set thread context of 1812	212	explorer.exe	102
PID 3536 set thread context of 4028	3536	spoolsv.exe	138
PID 4084 set thread context of 4700	4084	spoolsv.exe	140
PID 2116 set thread context of 1332	2116	spoolsv.exe	141
PID 5036 set thread context of 4576	5036	spoolsv.exe	143
PID 220 set thread context of 4812	220	spoolsv.exe	144
PID 4092 set thread context of 1472	4092	spoolsv.exe	145
PID 4444 set thread context of 3248	4444	spoolsv.exe	146
PID 5068 set thread context of 3680	5068	spoolsv.exe	147
PID 4848 set thread context of 876	4848	spoolsv.exe	148
PID 5052 set thread context of 1228	5052	spoolsv.exe	150
PID 5064 set thread context of 1276	5064	spoolsv.exe	152
PID 3828 set thread context of 4596	3828	spoolsv.exe	153
PID 4008 set thread context of 4852	4008	spoolsv.exe	154
PID 1204 set thread context of 1728	1204	spoolsv.exe	155
PID 1444 set thread context of 1748	1444	spoolsv.exe	156
PID 4916 set thread context of 1244	4916	spoolsv.exe	160
PID 3208 set thread context of 4860	3208	spoolsv.exe	161
PID 4920 set thread context of 1876	4920	spoolsv.exe	162
PID 1492 set thread context of 2764	1492	spoolsv.exe	163
PID 3304 set thread context of 4788	3304	spoolsv.exe	165
PID 3636 set thread context of 2140	3636	spoolsv.exe	167
PID 4336 set thread context of 4372	4336	spoolsv.exe	168
PID 3176 set thread context of 3336	3176	spoolsv.exe	169
PID 3488 set thread context of 4756	3488	spoolsv.exe	170
PID 4996 set thread context of 3712	4996	spoolsv.exe	172
PID 508 set thread context of 2408	508	spoolsv.exe	174
PID 636 set thread context of 2276	636	spoolsv.exe	175
PID 1976 set thread context of 3132	1976	spoolsv.exe	176
PID 5100 set thread context of 4100	5100	spoolsv.exe	177
PID 4716 set thread context of 1576	4716	spoolsv.exe	179
PID 1848 set thread context of 4872	1848	spoolsv.exe	181
PID 3404 set thread context of 3012	3404	spoolsv.exe	182
PID 384 set thread context of 4464	384	spoolsv.exe	184
PID 3696 set thread context of 4780	3696	spoolsv.exe	191
PID 4556 set thread context of 5256	4556	explorer.exe	200
PID 396 set thread context of 5624	396	spoolsv.exe	202
PID 1912 set thread context of 3628	1912	explorer.exe	211
PID 4512 set thread context of 404	4512	spoolsv.exe	212
PID 840 set thread context of 5296	840	explorer.exe	216
PID 4196 set thread context of 760	4196	spoolsv.exe	218

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4592	c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe
4592	c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1812	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4592	c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe
4592	c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
1812	explorer.exe
4028	spoolsv.exe
4028	spoolsv.exe
4700	spoolsv.exe
4700	spoolsv.exe
1332	spoolsv.exe
1332	spoolsv.exe
4576	spoolsv.exe
4576	spoolsv.exe
4812	spoolsv.exe
4812	spoolsv.exe
1472	spoolsv.exe
1472	spoolsv.exe
3248	spoolsv.exe
3248	spoolsv.exe
3680	spoolsv.exe
3680	spoolsv.exe
876	spoolsv.exe
876	spoolsv.exe
1228	spoolsv.exe
1228	spoolsv.exe
1276	spoolsv.exe
1276	spoolsv.exe
4596	spoolsv.exe
4596	spoolsv.exe
4852	spoolsv.exe
4852	spoolsv.exe
1728	spoolsv.exe
1728	spoolsv.exe
1748	spoolsv.exe
1748	spoolsv.exe
1244	spoolsv.exe
1244	spoolsv.exe
4860	spoolsv.exe
4860	spoolsv.exe
1876	spoolsv.exe
1876	spoolsv.exe
2764	spoolsv.exe
2764	spoolsv.exe
4788	spoolsv.exe
4788	spoolsv.exe
2140	spoolsv.exe
2140	spoolsv.exe
4372	spoolsv.exe
4372	spoolsv.exe
3336	spoolsv.exe
3336	spoolsv.exe
4756	spoolsv.exe
4756	spoolsv.exe
3712	spoolsv.exe
3712	spoolsv.exe
2408	spoolsv.exe
2408	spoolsv.exe
2276	spoolsv.exe
2276	spoolsv.exe
3132	spoolsv.exe
3132	spoolsv.exe
4100	spoolsv.exe
4100	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 4072	1728	c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe	84
PID 1728 wrote to memory of 4072	1728	c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe	84
PID 1728 wrote to memory of 4592	1728	c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe	97
PID 1728 wrote to memory of 4592	1728	c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe	97
PID 1728 wrote to memory of 4592	1728	c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe	97
PID 1728 wrote to memory of 4592	1728	c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe	97
PID 1728 wrote to memory of 4592	1728	c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe	97
PID 4592 wrote to memory of 212	4592	c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe	98
PID 4592 wrote to memory of 212	4592	c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe	98
PID 4592 wrote to memory of 212	4592	c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe	98
PID 212 wrote to memory of 1812	212	explorer.exe	102
PID 212 wrote to memory of 1812	212	explorer.exe	102
PID 212 wrote to memory of 1812	212	explorer.exe	102
PID 212 wrote to memory of 1812	212	explorer.exe	102
PID 212 wrote to memory of 1812	212	explorer.exe	102
PID 1812 wrote to memory of 3536	1812	explorer.exe	103
PID 1812 wrote to memory of 3536	1812	explorer.exe	103
PID 1812 wrote to memory of 3536	1812	explorer.exe	103
PID 1812 wrote to memory of 4084	1812	explorer.exe	104
PID 1812 wrote to memory of 4084	1812	explorer.exe	104
PID 1812 wrote to memory of 4084	1812	explorer.exe	104
PID 1812 wrote to memory of 2116	1812	explorer.exe	105
PID 1812 wrote to memory of 2116	1812	explorer.exe	105
PID 1812 wrote to memory of 2116	1812	explorer.exe	105
PID 1812 wrote to memory of 5036	1812	explorer.exe	106
PID 1812 wrote to memory of 5036	1812	explorer.exe	106
PID 1812 wrote to memory of 5036	1812	explorer.exe	106
PID 1812 wrote to memory of 220	1812	explorer.exe	107
PID 1812 wrote to memory of 220	1812	explorer.exe	107
PID 1812 wrote to memory of 220	1812	explorer.exe	107
PID 1812 wrote to memory of 4092	1812	explorer.exe	108
PID 1812 wrote to memory of 4092	1812	explorer.exe	108
PID 1812 wrote to memory of 4092	1812	explorer.exe	108
PID 1812 wrote to memory of 4444	1812	explorer.exe	109
PID 1812 wrote to memory of 4444	1812	explorer.exe	109
PID 1812 wrote to memory of 4444	1812	explorer.exe	109
PID 1812 wrote to memory of 5068	1812	explorer.exe	111
PID 1812 wrote to memory of 5068	1812	explorer.exe	111
PID 1812 wrote to memory of 5068	1812	explorer.exe	111
PID 1812 wrote to memory of 4848	1812	explorer.exe	112
PID 1812 wrote to memory of 4848	1812	explorer.exe	112
PID 1812 wrote to memory of 4848	1812	explorer.exe	112
PID 1812 wrote to memory of 5052	1812	explorer.exe	113
PID 1812 wrote to memory of 5052	1812	explorer.exe	113
PID 1812 wrote to memory of 5052	1812	explorer.exe	113
PID 1812 wrote to memory of 5064	1812	explorer.exe	114
PID 1812 wrote to memory of 5064	1812	explorer.exe	114
PID 1812 wrote to memory of 5064	1812	explorer.exe	114
PID 1812 wrote to memory of 3828	1812	explorer.exe	115
PID 1812 wrote to memory of 3828	1812	explorer.exe	115
PID 1812 wrote to memory of 3828	1812	explorer.exe	115
PID 1812 wrote to memory of 4008	1812	explorer.exe	116
PID 1812 wrote to memory of 4008	1812	explorer.exe	116
PID 1812 wrote to memory of 4008	1812	explorer.exe	116
PID 1812 wrote to memory of 1204	1812	explorer.exe	117
PID 1812 wrote to memory of 1204	1812	explorer.exe	117
PID 1812 wrote to memory of 1204	1812	explorer.exe	117
PID 1812 wrote to memory of 1444	1812	explorer.exe	118
PID 1812 wrote to memory of 1444	1812	explorer.exe	118
PID 1812 wrote to memory of 1444	1812	explorer.exe	118
PID 1812 wrote to memory of 4916	1812	explorer.exe	119
PID 1812 wrote to memory of 4916	1812	explorer.exe	119
PID 1812 wrote to memory of 4916	1812	explorer.exe	119
PID 1812 wrote to memory of 3208	1812	explorer.exe	120

C:\Users\Admin\AppData\Local\Temp\c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4072
- C:\Users\Admin\AppData\Local\Temp\c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c12faa86d1a1ea88b51123f5f7be7802_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4592
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:212
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3536
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4028
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4556
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4084
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2116
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3248
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4848
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:876
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1912
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3828
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1204
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1748
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:840
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4916
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4788
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3084
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3636
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4336
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3176
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3488
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4996
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3712
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2808
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:508
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:636
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1976
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5100
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4716
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1576
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2980
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1848
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3404
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:384
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4464
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3596
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:6008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3696
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4780
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4876
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5624
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5676
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:404
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5212
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:760
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2984
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4380
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4432
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2240
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2508
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5816
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1240
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1136
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3268
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1636
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2476
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:60
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5168
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5960
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2044
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5828
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2716
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:6064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
265bafb841fe678b1fcfbb960834e051

SHA1
6aa5830c579d06559d6794153b7bd9d7ded99b9e

SHA256
df49c229cf4f33581846e61e04eb22cdd1f0ecad3a918adfb8cbed8ea823166c

SHA512
306d64a8f52c19b76bab0bef1be558207f15b8054f80bc7dbeb5935a2c563838cca4023e254517c3d1ca9525c37a6ec0586f8d47200309a98347df7f6957a972

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
aca1e39cc03671bb88e0b45ba77cb801

SHA1
becf6716b09315654f01f072ecea5a606a3db7dc

SHA256
a088df9f63cd7aea19dcddd2e9f29a43e057eaed896bfc6c25712de6f0c3834f

SHA512
f6a5c845168f8cac6dc3936bcbd1ae6820e08abe0cdab5c4471298292bef981df3094c418cd136ccef5d8163f9a0c865c07fdcbf256428ef9c29a95ae22e91fc

Download Submit
memory/212-112-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/212-106-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/220-1356-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/404-4771-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/760-4957-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/760-5066-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/876-2613-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/876-2793-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1204-1918-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1228-2675-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1244-2923-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1244-2919-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1276-2716-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1332-2414-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1444-1919-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1472-2524-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1492-2182-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1576-3406-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1728-0-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/1728-52-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/1728-59-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1728-51-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1728-2746-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1748-2827-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1748-2988-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1812-4956-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1812-901-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1812-111-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1876-2939-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2044-5686-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2116-1174-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2116-2421-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2140-3102-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2240-5376-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2408-3287-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2764-2958-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2868-5699-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2876-5526-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3012-3422-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3132-3306-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3176-2384-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3208-2098-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3248-2533-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3304-2234-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3336-3123-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3488-2392-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3536-2383-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3536-972-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3628-4677-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3636-2296-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3680-2547-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3712-3269-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3828-1755-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4008-1836-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4028-2605-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4028-2385-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4084-1083-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4084-2396-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4092-1367-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4100-3316-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4336-2377-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4364-5639-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4372-3113-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4380-5278-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4444-1433-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4464-3666-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4500-5386-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4508-5472-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4576-2503-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4592-93-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/4592-56-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4592-95-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4592-55-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4596-2727-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4660-5690-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4700-2394-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4756-3135-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4756-3132-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4780-3971-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4788-3187-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4812-2511-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4848-1580-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4852-2735-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4872-3415-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4916-2006-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4920-2181-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5036-1245-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5052-1686-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5064-1687-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5068-1509-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5244-5613-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5256-4263-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5624-4450-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5684-5714-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5816-5462-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5816-5677-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5900-5482-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5936-5143-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6008-5493-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6016-5648-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download