pony | 50210546f586a834eaa4b2e818346de891a9e418df61acf0b9dd784abadc11d2

Analysis

max time kernel
150s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe
Size

2.2MB
MD5

f0c7e2c3bce30b89e4e7a5b61f7dbe17
SHA1

aead46144e5a88560c065455da0475a394889fc8
SHA256

50210546f586a834eaa4b2e818346de891a9e418df61acf0b9dd784abadc11d2
SHA512

885fd25c554a22108cfc558368bb782b08e9de34e3d45570a4d7ab01f84d275a4350cc285436b37ad736696a7ae839990891a5f1d9b62fbbc1255613f3a721b8
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZg:0UzeyQMS4DqodCnoe+iitjWwwk

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe	f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe	f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
4072	explorer.exe
1112	explorer.exe
4032	spoolsv.exe
2696	spoolsv.exe
3448	spoolsv.exe
2120	spoolsv.exe
3400	spoolsv.exe
4872	spoolsv.exe
4164	spoolsv.exe
4516	spoolsv.exe
3376	spoolsv.exe
4332	spoolsv.exe
3800	spoolsv.exe
3232	spoolsv.exe
4484	spoolsv.exe
5012	spoolsv.exe
2280	spoolsv.exe
1656	spoolsv.exe
4292	spoolsv.exe
3068	spoolsv.exe
3484	spoolsv.exe
4648	spoolsv.exe
1980	spoolsv.exe
3104	spoolsv.exe
4396	spoolsv.exe
784	spoolsv.exe
4936	spoolsv.exe
4312	spoolsv.exe
1596	spoolsv.exe
4168	spoolsv.exe
1712	spoolsv.exe
3968	spoolsv.exe
1208	explorer.exe
3492	spoolsv.exe
1868	spoolsv.exe
5020	spoolsv.exe
208	spoolsv.exe
5092	spoolsv.exe
2460	explorer.exe
932	spoolsv.exe
4008	spoolsv.exe
4564	spoolsv.exe
4028	spoolsv.exe
320	spoolsv.exe
4992	spoolsv.exe
1448	explorer.exe
1264	spoolsv.exe
4968	spoolsv.exe
3548	spoolsv.exe
2996	spoolsv.exe
3724	explorer.exe
4528	spoolsv.exe
1904	spoolsv.exe
1280	spoolsv.exe
3284	spoolsv.exe
608	explorer.exe
4728	spoolsv.exe
2380	spoolsv.exe
5024	spoolsv.exe
3324	spoolsv.exe
636	spoolsv.exe
1512	explorer.exe
3936	spoolsv.exe
3336	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 41 IoCs

description	pid	Process	procid_target
PID 4888 set thread context of 1632	4888	f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe	91
PID 4072 set thread context of 1112	4072	explorer.exe	95
PID 4032 set thread context of 3968	4032	spoolsv.exe	125
PID 2696 set thread context of 1868	2696	spoolsv.exe	128
PID 3448 set thread context of 5020	3448	spoolsv.exe	129
PID 2120 set thread context of 208	2120	spoolsv.exe	130
PID 3400 set thread context of 5092	3400	spoolsv.exe	131
PID 4872 set thread context of 4008	4872	spoolsv.exe	134
PID 4164 set thread context of 4564	4164	spoolsv.exe	135
PID 4516 set thread context of 4028	4516	spoolsv.exe	136
PID 3376 set thread context of 4992	3376	spoolsv.exe	138
PID 4332 set thread context of 1264	4332	spoolsv.exe	140
PID 3800 set thread context of 4968	3800	spoolsv.exe	141
PID 3232 set thread context of 2996	3232	spoolsv.exe	143
PID 4484 set thread context of 4528	4484	spoolsv.exe	145
PID 5012 set thread context of 1904	5012	spoolsv.exe	146
PID 2280 set thread context of 3284	2280	spoolsv.exe	148
PID 1656 set thread context of 4728	1656	spoolsv.exe	150
PID 4292 set thread context of 2380	4292	spoolsv.exe	151
PID 3068 set thread context of 5024	3068	spoolsv.exe	152
PID 3484 set thread context of 636	3484	spoolsv.exe	154
PID 4648 set thread context of 3936	4648	spoolsv.exe	156
PID 1980 set thread context of 3336	1980	spoolsv.exe	157
PID 3104 set thread context of 1604	3104	spoolsv.exe	158
PID 4396 set thread context of 1268	4396	spoolsv.exe	160
PID 784 set thread context of 4900	784	spoolsv.exe	162
PID 4936 set thread context of 2860	4936	spoolsv.exe	163
PID 4312 set thread context of 2432	4312	spoolsv.exe	164
PID 1596 set thread context of 2448	1596	spoolsv.exe	166
PID 4168 set thread context of 3196	4168	spoolsv.exe	168
PID 1712 set thread context of 4816	1712	spoolsv.exe	170
PID 1208 set thread context of 4788	1208	explorer.exe	175
PID 3492 set thread context of 1568	3492	spoolsv.exe	176
PID 2460 set thread context of 1464	2460	explorer.exe	179
PID 932 set thread context of 1340	932	spoolsv.exe	180
PID 320 set thread context of 1760	320	spoolsv.exe	184
PID 1448 set thread context of 1688	1448	explorer.exe	186
PID 3548 set thread context of 4760	3548	spoolsv.exe	189
PID 3724 set thread context of 4352	3724	explorer.exe	192
PID 1280 set thread context of 4240	1280	spoolsv.exe	195
PID 608 set thread context of 1016	608	explorer.exe	197

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1632	f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe
1632	f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1632	f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe
1632	f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
1112	explorer.exe
3968	spoolsv.exe
3968	spoolsv.exe
1868	spoolsv.exe
1868	spoolsv.exe
5020	spoolsv.exe
5020	spoolsv.exe
208	spoolsv.exe
208	spoolsv.exe
5092	spoolsv.exe
5092	spoolsv.exe
4008	spoolsv.exe
4008	spoolsv.exe
4564	spoolsv.exe
4564	spoolsv.exe
4028	spoolsv.exe
4028	spoolsv.exe
4992	spoolsv.exe
4992	spoolsv.exe
1264	spoolsv.exe
1264	spoolsv.exe
4968	spoolsv.exe
4968	spoolsv.exe
2996	spoolsv.exe
2996	spoolsv.exe
4528	spoolsv.exe
4528	spoolsv.exe
1904	spoolsv.exe
1904	spoolsv.exe
3284	spoolsv.exe
3284	spoolsv.exe
4728	spoolsv.exe
4728	spoolsv.exe
2380	spoolsv.exe
2380	spoolsv.exe
5024	spoolsv.exe
5024	spoolsv.exe
636	spoolsv.exe
636	spoolsv.exe
3936	spoolsv.exe
3936	spoolsv.exe
3336	spoolsv.exe
3336	spoolsv.exe
1604	spoolsv.exe
1604	spoolsv.exe
1268	spoolsv.exe
1268	spoolsv.exe
4900	spoolsv.exe
4900	spoolsv.exe
2860	spoolsv.exe
2860	spoolsv.exe
2432	spoolsv.exe
2432	spoolsv.exe
2448	spoolsv.exe
2448	spoolsv.exe
3196	spoolsv.exe
3196	spoolsv.exe
4816	spoolsv.exe
4816	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 2976	4888	f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe	82
PID 4888 wrote to memory of 2976	4888	f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe	82
PID 4888 wrote to memory of 1632	4888	f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe	91
PID 4888 wrote to memory of 1632	4888	f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe	91
PID 4888 wrote to memory of 1632	4888	f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe	91
PID 4888 wrote to memory of 1632	4888	f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe	91
PID 4888 wrote to memory of 1632	4888	f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe	91
PID 1632 wrote to memory of 4072	1632	f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe	92
PID 1632 wrote to memory of 4072	1632	f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe	92
PID 1632 wrote to memory of 4072	1632	f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe	92
PID 4072 wrote to memory of 1112	4072	explorer.exe	95
PID 4072 wrote to memory of 1112	4072	explorer.exe	95
PID 4072 wrote to memory of 1112	4072	explorer.exe	95
PID 4072 wrote to memory of 1112	4072	explorer.exe	95
PID 4072 wrote to memory of 1112	4072	explorer.exe	95
PID 1112 wrote to memory of 4032	1112	explorer.exe	96
PID 1112 wrote to memory of 4032	1112	explorer.exe	96
PID 1112 wrote to memory of 4032	1112	explorer.exe	96
PID 1112 wrote to memory of 2696	1112	explorer.exe	97
PID 1112 wrote to memory of 2696	1112	explorer.exe	97
PID 1112 wrote to memory of 2696	1112	explorer.exe	97
PID 1112 wrote to memory of 3448	1112	explorer.exe	98
PID 1112 wrote to memory of 3448	1112	explorer.exe	98
PID 1112 wrote to memory of 3448	1112	explorer.exe	98
PID 1112 wrote to memory of 2120	1112	explorer.exe	99
PID 1112 wrote to memory of 2120	1112	explorer.exe	99
PID 1112 wrote to memory of 2120	1112	explorer.exe	99
PID 1112 wrote to memory of 3400	1112	explorer.exe	100
PID 1112 wrote to memory of 3400	1112	explorer.exe	100
PID 1112 wrote to memory of 3400	1112	explorer.exe	100
PID 1112 wrote to memory of 4872	1112	explorer.exe	101
PID 1112 wrote to memory of 4872	1112	explorer.exe	101
PID 1112 wrote to memory of 4872	1112	explorer.exe	101
PID 1112 wrote to memory of 4164	1112	explorer.exe	102
PID 1112 wrote to memory of 4164	1112	explorer.exe	102
PID 1112 wrote to memory of 4164	1112	explorer.exe	102
PID 1112 wrote to memory of 4516	1112	explorer.exe	103
PID 1112 wrote to memory of 4516	1112	explorer.exe	103
PID 1112 wrote to memory of 4516	1112	explorer.exe	103
PID 1112 wrote to memory of 3376	1112	explorer.exe	104
PID 1112 wrote to memory of 3376	1112	explorer.exe	104
PID 1112 wrote to memory of 3376	1112	explorer.exe	104
PID 1112 wrote to memory of 4332	1112	explorer.exe	105
PID 1112 wrote to memory of 4332	1112	explorer.exe	105
PID 1112 wrote to memory of 4332	1112	explorer.exe	105
PID 1112 wrote to memory of 3800	1112	explorer.exe	106
PID 1112 wrote to memory of 3800	1112	explorer.exe	106
PID 1112 wrote to memory of 3800	1112	explorer.exe	106
PID 1112 wrote to memory of 3232	1112	explorer.exe	107
PID 1112 wrote to memory of 3232	1112	explorer.exe	107
PID 1112 wrote to memory of 3232	1112	explorer.exe	107
PID 1112 wrote to memory of 4484	1112	explorer.exe	108
PID 1112 wrote to memory of 4484	1112	explorer.exe	108
PID 1112 wrote to memory of 4484	1112	explorer.exe	108
PID 1112 wrote to memory of 5012	1112	explorer.exe	109
PID 1112 wrote to memory of 5012	1112	explorer.exe	109
PID 1112 wrote to memory of 5012	1112	explorer.exe	109
PID 1112 wrote to memory of 2280	1112	explorer.exe	110
PID 1112 wrote to memory of 2280	1112	explorer.exe	110
PID 1112 wrote to memory of 2280	1112	explorer.exe	110
PID 1112 wrote to memory of 1656	1112	explorer.exe	111
PID 1112 wrote to memory of 1656	1112	explorer.exe	111
PID 1112 wrote to memory of 1656	1112	explorer.exe	111
PID 1112 wrote to memory of 4292	1112	explorer.exe	112

C:\Users\Admin\AppData\Local\Temp\f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2976
- C:\Users\Admin\AppData\Local\Temp\f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f0c7e2c3bce30b89e4e7a5b61f7dbe17_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1632
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4072
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4032
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3968
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1208
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2696
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5092
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2460
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4516
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4992
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1448
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3800
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3232
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2996
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3724
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2280
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3284
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:608
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1656
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:636
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1512
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4648
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1980
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1268
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3348
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:784
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4312
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2448
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3532
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4168
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1712
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4816
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2344
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1568
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3140
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:932
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1340
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4456
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:320
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1760
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3548
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4760
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1280
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4240
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3324
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3576
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3600
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2156
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3756
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4304
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4932
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3176
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4820
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2320
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1820
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4948
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
aa3a2e59945049bb10f38043c1b9f623

SHA1
f58847feb0862e4903d286d5bc1683be56ed6e6c

SHA256
974b4db47a4c290edc1f26a0624c4fac3471cce46488840fe215a12b1ef12973

SHA512
4f86b736cc29e199b8c8f0cdac3ec49c2d5657662c2c13f3afe6d779cdfa9f989aa95d3c3f84bc8edf55556994344373b767d5d226335a1eac2f8eac8f303783

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
16102b98bbd19acb5f2dc84915632fa1

SHA1
188ab17562ace06106780346d9a457a654e2ff1e

SHA256
61b09267a5ffa2898dbf64bd234331659a45755f35e834ce9135fcbef1b6c7bc

SHA512
098ab90b0b2467aa077af3e14af16c5a4d9279b4ff2dd89e90cb54ad656fd3e74b5d27af59fc4f4109ce96fdf645df5f8fda0a63e37c5bc18ec0ec5e1e7181e8

Download Submit
memory/208-2085-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/636-3005-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/804-5149-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1016-4376-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1112-109-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1112-721-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1112-4153-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1264-2446-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1268-3054-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1340-3885-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1440-4896-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1464-3731-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1568-3592-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1568-3710-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1604-2914-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1632-49-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1632-50-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1632-93-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1656-1862-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1688-3955-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1760-3945-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1820-5363-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1836-4932-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1868-2061-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/1868-2063-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1904-2625-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1904-2629-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1980-2073-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2120-1048-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2120-2084-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2156-4849-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2156-4705-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2280-1795-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2380-2786-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2432-3082-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2448-3234-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2448-3350-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2472-4716-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2696-2065-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2696-936-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2736-5009-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2860-3072-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2996-2716-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2996-2605-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3068-1961-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3104-2082-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3196-3241-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3228-4546-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3232-1573-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3284-2764-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3336-2905-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3376-1328-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3400-1114-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3448-987-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3448-2075-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3484-1978-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3488-5136-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3488-5141-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3576-4618-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3576-4534-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3800-1467-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3936-2894-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3936-2898-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3968-1979-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3968-2148-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4008-2261-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4028-2281-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4028-2286-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4032-803-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4032-2000-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4036-5373-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4072-110-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4072-104-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4164-1181-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4240-4366-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4292-1914-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4304-4923-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4332-1400-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4352-4228-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4484-1640-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4500-5382-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4516-1257-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4528-2614-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4528-2617-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4564-2271-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4648-2062-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4728-2774-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4760-4158-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4788-3584-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4816-3459-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4820-5246-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4820-5126-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4872-1180-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4888-46-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4888-54-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4888-47-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/4888-0-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/4900-3064-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4900-3062-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4968-2459-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4988-4812-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4988-4826-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4992-2437-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5012-1717-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5020-2074-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5024-2794-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5092-2349-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5092-2177-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download