pony | abb2d14fa1ecac6922931b3e37b6f3d6ea693d3d68315257170e0e3c4a08f018

Analysis

max time kernel
134s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe
Size

2.2MB
MD5

eddd16936697d915d4df8fdf0b4d73ad
SHA1

b2905a943a493fdd32f4d4c1dad013eab7f9aa85
SHA256

abb2d14fa1ecac6922931b3e37b6f3d6ea693d3d68315257170e0e3c4a08f018
SHA512

dde408da909be06036b251d2c0aff586a156fdc8793af4cf4a52ca139157fab82cb9226cff5726662db44753ce190fcb740b2192e4cdafa51ad3e0ece7d7da92
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ6:0UzeyQMS4DqodCnoe+iitjWww+

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
4476	explorer.exe
3108	explorer.exe
460	spoolsv.exe
3284	spoolsv.exe
644	spoolsv.exe
4412	spoolsv.exe
4900	spoolsv.exe
4864	spoolsv.exe
5024	spoolsv.exe
2824	spoolsv.exe
3528	spoolsv.exe
1496	spoolsv.exe
2060	spoolsv.exe
2200	spoolsv.exe
928	spoolsv.exe
2964	spoolsv.exe
2000	spoolsv.exe
3092	spoolsv.exe
4288	spoolsv.exe
1108	spoolsv.exe
2260	spoolsv.exe
376	spoolsv.exe
444	spoolsv.exe
4972	spoolsv.exe
3492	spoolsv.exe
3324	spoolsv.exe
4992	spoolsv.exe
4564	spoolsv.exe
4376	spoolsv.exe
4608	spoolsv.exe
4028	spoolsv.exe
3816	spoolsv.exe
616	spoolsv.exe
4560	explorer.exe
2040	spoolsv.exe
1952	spoolsv.exe
3360	spoolsv.exe
1940	explorer.exe
2728	spoolsv.exe
4868	spoolsv.exe
1324	spoolsv.exe
992	spoolsv.exe
4508	spoolsv.exe
2228	spoolsv.exe
1412	explorer.exe
1272	spoolsv.exe
620	spoolsv.exe
4616	spoolsv.exe
4996	spoolsv.exe
3724	spoolsv.exe
1288	spoolsv.exe
3088	spoolsv.exe
2528	explorer.exe
3840	spoolsv.exe
4056	spoolsv.exe
4200	spoolsv.exe
4484	spoolsv.exe
4692	explorer.exe
380	spoolsv.exe
3556	spoolsv.exe
1856	spoolsv.exe
4120	spoolsv.exe
2164	spoolsv.exe
1780	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 43 IoCs

description	pid	Process	procid_target
PID 4976 set thread context of 2128	4976	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe	91
PID 4476 set thread context of 3108	4476	explorer.exe	95
PID 460 set thread context of 616	460	spoolsv.exe	126
PID 3284 set thread context of 2040	3284	spoolsv.exe	128
PID 644 set thread context of 3360	644	spoolsv.exe	130
PID 4412 set thread context of 2728	4412	spoolsv.exe	132
PID 4900 set thread context of 4868	4900	spoolsv.exe	133
PID 4864 set thread context of 1324	4864	spoolsv.exe	134
PID 5024 set thread context of 4508	5024	spoolsv.exe	136
PID 2824 set thread context of 2228	2824	spoolsv.exe	137
PID 3528 set thread context of 1272	3528	spoolsv.exe	139
PID 1496 set thread context of 620	1496	spoolsv.exe	140
PID 2060 set thread context of 4616	2060	spoolsv.exe	141
PID 2200 set thread context of 4996	2200	spoolsv.exe	142
PID 928 set thread context of 3724	928	spoolsv.exe	143
PID 2964 set thread context of 3088	2964	spoolsv.exe	145
PID 2000 set thread context of 3840	2000	spoolsv.exe	147
PID 3092 set thread context of 4056	3092	spoolsv.exe	148
PID 4288 set thread context of 4484	4288	spoolsv.exe	150
PID 1108 set thread context of 380	1108	spoolsv.exe	152
PID 2260 set thread context of 3556	2260	spoolsv.exe	153
PID 376 set thread context of 1856	376	spoolsv.exe	154
PID 444 set thread context of 2164	444	spoolsv.exe	156
PID 4972 set thread context of 868	4972	spoolsv.exe	158
PID 3492 set thread context of 4416	3492	spoolsv.exe	159
PID 3324 set thread context of 1840	3324	spoolsv.exe	161
PID 4992 set thread context of 1364	4992	spoolsv.exe	162
PID 4564 set thread context of 4488	4564	spoolsv.exe	164
PID 4376 set thread context of 2208	4376	spoolsv.exe	165
PID 4608 set thread context of 2724	4608	spoolsv.exe	167
PID 4028 set thread context of 5084	4028	spoolsv.exe	169
PID 4560 set thread context of 3488	4560	explorer.exe	171
PID 3816 set thread context of 2064	3816	spoolsv.exe	173
PID 1952 set thread context of 4600	1952	spoolsv.exe	178
PID 1940 set thread context of 2108	1940	explorer.exe	181
PID 1412 set thread context of 4132	1412	explorer.exe	184
PID 992 set thread context of 3804	992	spoolsv.exe	185
PID 2528 set thread context of 632	2528	explorer.exe	189
PID 1288 set thread context of 3560	1288	spoolsv.exe	190
PID 4200 set thread context of 1036	4200	spoolsv.exe	195
PID 4692 set thread context of 3376	4692	explorer.exe	197
PID 4120 set thread context of 4740	4120	spoolsv.exe	200
PID 1780 set thread context of 1368	1780	explorer.exe	203

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2128	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe
2128	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3108	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2128	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe
2128	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
3108	explorer.exe
616	spoolsv.exe
616	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
3360	spoolsv.exe
3360	spoolsv.exe
2728	spoolsv.exe
2728	spoolsv.exe
4868	spoolsv.exe
4868	spoolsv.exe
1324	spoolsv.exe
1324	spoolsv.exe
4508	spoolsv.exe
4508	spoolsv.exe
2228	spoolsv.exe
2228	spoolsv.exe
1272	spoolsv.exe
1272	spoolsv.exe
620	spoolsv.exe
620	spoolsv.exe
4616	spoolsv.exe
4616	spoolsv.exe
4996	spoolsv.exe
4996	spoolsv.exe
3724	spoolsv.exe
3724	spoolsv.exe
3088	spoolsv.exe
3088	spoolsv.exe
3840	spoolsv.exe
3840	spoolsv.exe
4056	spoolsv.exe
4056	spoolsv.exe
4484	spoolsv.exe
4484	spoolsv.exe
380	spoolsv.exe
380	spoolsv.exe
3556	spoolsv.exe
3556	spoolsv.exe
1856	spoolsv.exe
1856	spoolsv.exe
2164	spoolsv.exe
2164	spoolsv.exe
868	spoolsv.exe
868	spoolsv.exe
4416	spoolsv.exe
4416	spoolsv.exe
1840	spoolsv.exe
1840	spoolsv.exe
1364	spoolsv.exe
1364	spoolsv.exe
4488	spoolsv.exe
4488	spoolsv.exe
2208	spoolsv.exe
2208	spoolsv.exe
2724	spoolsv.exe
2724	spoolsv.exe
5084	spoolsv.exe
5084	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 1068	4976	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe	82
PID 4976 wrote to memory of 1068	4976	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe	82
PID 4976 wrote to memory of 2128	4976	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe	91
PID 4976 wrote to memory of 2128	4976	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe	91
PID 4976 wrote to memory of 2128	4976	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe	91
PID 4976 wrote to memory of 2128	4976	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe	91
PID 4976 wrote to memory of 2128	4976	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe	91
PID 2128 wrote to memory of 4476	2128	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe	92
PID 2128 wrote to memory of 4476	2128	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe	92
PID 2128 wrote to memory of 4476	2128	eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe	92
PID 4476 wrote to memory of 3108	4476	explorer.exe	95
PID 4476 wrote to memory of 3108	4476	explorer.exe	95
PID 4476 wrote to memory of 3108	4476	explorer.exe	95
PID 4476 wrote to memory of 3108	4476	explorer.exe	95
PID 4476 wrote to memory of 3108	4476	explorer.exe	95
PID 3108 wrote to memory of 460	3108	explorer.exe	96
PID 3108 wrote to memory of 460	3108	explorer.exe	96
PID 3108 wrote to memory of 460	3108	explorer.exe	96
PID 3108 wrote to memory of 3284	3108	explorer.exe	97
PID 3108 wrote to memory of 3284	3108	explorer.exe	97
PID 3108 wrote to memory of 3284	3108	explorer.exe	97
PID 3108 wrote to memory of 644	3108	explorer.exe	98
PID 3108 wrote to memory of 644	3108	explorer.exe	98
PID 3108 wrote to memory of 644	3108	explorer.exe	98
PID 3108 wrote to memory of 4412	3108	explorer.exe	99
PID 3108 wrote to memory of 4412	3108	explorer.exe	99
PID 3108 wrote to memory of 4412	3108	explorer.exe	99
PID 3108 wrote to memory of 4900	3108	explorer.exe	100
PID 3108 wrote to memory of 4900	3108	explorer.exe	100
PID 3108 wrote to memory of 4900	3108	explorer.exe	100
PID 3108 wrote to memory of 4864	3108	explorer.exe	101
PID 3108 wrote to memory of 4864	3108	explorer.exe	101
PID 3108 wrote to memory of 4864	3108	explorer.exe	101
PID 3108 wrote to memory of 5024	3108	explorer.exe	102
PID 3108 wrote to memory of 5024	3108	explorer.exe	102
PID 3108 wrote to memory of 5024	3108	explorer.exe	102
PID 3108 wrote to memory of 2824	3108	explorer.exe	103
PID 3108 wrote to memory of 2824	3108	explorer.exe	103
PID 3108 wrote to memory of 2824	3108	explorer.exe	103
PID 3108 wrote to memory of 3528	3108	explorer.exe	104
PID 3108 wrote to memory of 3528	3108	explorer.exe	104
PID 3108 wrote to memory of 3528	3108	explorer.exe	104
PID 3108 wrote to memory of 1496	3108	explorer.exe	105
PID 3108 wrote to memory of 1496	3108	explorer.exe	105
PID 3108 wrote to memory of 1496	3108	explorer.exe	105
PID 3108 wrote to memory of 2060	3108	explorer.exe	106
PID 3108 wrote to memory of 2060	3108	explorer.exe	106
PID 3108 wrote to memory of 2060	3108	explorer.exe	106
PID 3108 wrote to memory of 2200	3108	explorer.exe	107
PID 3108 wrote to memory of 2200	3108	explorer.exe	107
PID 3108 wrote to memory of 2200	3108	explorer.exe	107
PID 3108 wrote to memory of 928	3108	explorer.exe	108
PID 3108 wrote to memory of 928	3108	explorer.exe	108
PID 3108 wrote to memory of 928	3108	explorer.exe	108
PID 3108 wrote to memory of 2964	3108	explorer.exe	109
PID 3108 wrote to memory of 2964	3108	explorer.exe	109
PID 3108 wrote to memory of 2964	3108	explorer.exe	109
PID 3108 wrote to memory of 2000	3108	explorer.exe	110
PID 3108 wrote to memory of 2000	3108	explorer.exe	110
PID 3108 wrote to memory of 2000	3108	explorer.exe	110
PID 3108 wrote to memory of 3092	3108	explorer.exe	111
PID 3108 wrote to memory of 3092	3108	explorer.exe	111
PID 3108 wrote to memory of 3092	3108	explorer.exe	111
PID 3108 wrote to memory of 4288	3108	explorer.exe	112

C:\Users\Admin\AppData\Local\Temp\eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1068
- C:\Users\Admin\AppData\Local\Temp\eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\eddd16936697d915d4df8fdf0b4d73ad_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2128
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:460
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:616
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4560
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3284
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3360
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1940
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4412
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4900
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4864
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5024
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2824
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2228
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1412
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3528
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2060
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2200
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3088
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2528
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4288
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4484
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4692
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2164
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1780
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4972
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3324
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1364
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:392
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2724
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3004
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3816
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2064
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1192
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4600
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1484
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3804
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1288
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3560
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4200
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1036
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4740
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3128
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4420
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3544
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3748
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:32
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2344
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4856
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4744
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4892
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
59ff5aec6d4b504cd724a7db438e68e2

SHA1
bfe63bef39e81d54666a13bc755b2729213a98b3

SHA256
07fd3ce77f78eec174d2dfa54e886aba3e82a251348e92c56f9b39935bf4e06e

SHA512
eac40b0e36dad6e17e1b6d79853b35deb8dccc6e0aab0ceb8fb2dd6f410a871fb120d7725c3c6ebc348d85a954f14b048a2d5c8121fd6c3f9e927d35dd82b8d8

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
87f251b25a9ed5ecfde694af5d969aa2

SHA1
a859679a75d74ecc957c1170a929c6e37ecc2dd0

SHA256
98ddf2ac762308b651c7d45e066de1308346df9f7bd587a4ef6c56bc9ad0490e

SHA512
64b722fe3e84e357a9d69a859e207e618be96bff15baed903506f6cc509d5f08f58331384a7585719fae71753990e303b41dec66480748fb9c65aaf0c12b996f

Download Submit
memory/376-1969-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/444-1975-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/452-5100-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/460-1966-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/460-771-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/616-2016-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/616-1964-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/632-4065-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/644-909-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/644-2090-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/868-2786-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/928-1537-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/960-4861-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1036-4342-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1036-4456-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1108-1877-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1324-2132-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1364-2977-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1364-3113-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1368-4605-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1404-5304-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1404-5308-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1496-1331-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1572-5110-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1840-2889-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1840-2886-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1856-2608-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1856-2612-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2000-1671-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2004-5093-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2040-1976-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2060-1388-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2108-3752-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2128-41-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2128-85-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2128-83-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/2128-40-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2164-2779-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2200-1455-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2208-2994-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2228-2287-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2228-2394-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2260-1963-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2296-5138-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2724-3131-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2724-3240-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2728-2102-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2824-1209-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2964-1614-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3064-5029-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3088-2468-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3088-2560-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3092-1723-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3108-102-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3108-3873-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3108-701-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3128-4680-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3284-831-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3284-1978-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3360-2274-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3376-4354-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3488-3260-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3492-2092-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3528-1330-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3544-4851-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3544-4975-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3556-2599-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3560-4187-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3724-2334-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3748-4998-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3748-5177-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3804-3989-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3832-5231-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3840-2478-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4056-2487-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4056-2492-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4132-3880-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4288-1795-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4412-965-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4416-2796-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4416-2800-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4476-101-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4476-96-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4484-2752-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4488-2988-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4508-2219-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4600-3589-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4600-3734-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4616-2312-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4712-4690-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4740-4663-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4864-1067-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4868-2111-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4900-1066-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4972-2074-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4976-0-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/4976-46-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4976-36-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4976-37-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/4996-2326-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5024-1128-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5084-3142-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download