Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 08:07
Behavioral task
behavioral1
Sample
0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
0056bfc2ee49646d65fc5dc2788cc0f8
-
SHA1
fe4370fbba5958793b85b30e3d7be1d2a05ade45
-
SHA256
8bdfa37734ccc1a44a15c6f573b0cecea0a9ff21ff661beaef6976baed41ba61
-
SHA512
3b00fbde07004a59c686a5bada232c4d96e12ee4692c85b14739cddac652640dc36c1e4c7b166bcc78f1b7ecc37e6cf9548fe4157dc4e72fa2667fecff5f7c6e
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZd:0UzeyQMS4DqodCnoe+iitjWww5
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe 0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe 0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 1316 explorer.exe 1740 explorer.exe 4680 spoolsv.exe 4040 spoolsv.exe 4876 spoolsv.exe 1140 spoolsv.exe 3428 spoolsv.exe 4788 spoolsv.exe 4284 spoolsv.exe 4496 spoolsv.exe 3876 spoolsv.exe 2776 spoolsv.exe 2852 spoolsv.exe 1916 spoolsv.exe 1664 spoolsv.exe 2692 spoolsv.exe 4148 spoolsv.exe 5024 spoolsv.exe 2440 spoolsv.exe 4892 spoolsv.exe 3220 spoolsv.exe 3852 spoolsv.exe 1464 spoolsv.exe 2756 spoolsv.exe 1448 spoolsv.exe 4940 spoolsv.exe 2356 spoolsv.exe 1620 spoolsv.exe 3576 spoolsv.exe 3596 spoolsv.exe 4684 spoolsv.exe 860 spoolsv.exe 3764 spoolsv.exe 5196 spoolsv.exe 5476 spoolsv.exe 5740 spoolsv.exe 6140 spoolsv.exe 3984 spoolsv.exe 5176 explorer.exe 5216 spoolsv.exe 5348 spoolsv.exe 5444 spoolsv.exe 5600 spoolsv.exe 5668 spoolsv.exe 5772 spoolsv.exe 2856 spoolsv.exe 5860 spoolsv.exe 5872 spoolsv.exe 5912 spoolsv.exe 6028 spoolsv.exe 1480 spoolsv.exe 5156 spoolsv.exe 5236 spoolsv.exe 5268 spoolsv.exe 5392 spoolsv.exe 5556 spoolsv.exe 5552 spoolsv.exe 5352 spoolsv.exe 5520 spoolsv.exe 5624 spoolsv.exe 3992 spoolsv.exe 1536 spoolsv.exe 4716 spoolsv.exe 5816 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 36 IoCs
description pid Process procid_target PID 2236 set thread context of 1840 2236 0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe 100 PID 1316 set thread context of 1740 1316 explorer.exe 105 PID 4680 set thread context of 3984 4680 spoolsv.exe 146 PID 4040 set thread context of 5216 4040 spoolsv.exe 148 PID 4876 set thread context of 5348 4876 spoolsv.exe 149 PID 1140 set thread context of 5444 1140 spoolsv.exe 150 PID 3428 set thread context of 5600 3428 spoolsv.exe 151 PID 4788 set thread context of 5668 4788 spoolsv.exe 152 PID 4284 set thread context of 5772 4284 spoolsv.exe 153 PID 4496 set thread context of 2856 4496 spoolsv.exe 154 PID 3876 set thread context of 5872 3876 spoolsv.exe 156 PID 2776 set thread context of 5912 2776 spoolsv.exe 157 PID 2852 set thread context of 6028 2852 spoolsv.exe 158 PID 1916 set thread context of 1480 1916 spoolsv.exe 159 PID 1664 set thread context of 5156 1664 spoolsv.exe 160 PID 2692 set thread context of 5236 2692 spoolsv.exe 162 PID 4148 set thread context of 5268 4148 spoolsv.exe 163 PID 5024 set thread context of 5392 5024 spoolsv.exe 164 PID 2440 set thread context of 5556 2440 spoolsv.exe 165 PID 4892 set thread context of 5352 4892 spoolsv.exe 166 PID 3220 set thread context of 5520 3220 spoolsv.exe 167 PID 3852 set thread context of 5624 3852 spoolsv.exe 169 PID 1464 set thread context of 3992 1464 spoolsv.exe 170 PID 5740 set thread context of 4716 5740 spoolsv.exe 171 PID 2756 set thread context of 1536 2756 spoolsv.exe 172 PID 1448 set thread context of 5816 1448 spoolsv.exe 173 PID 4940 set thread context of 5968 4940 spoolsv.exe 174 PID 2356 set thread context of 3088 2356 spoolsv.exe 175 PID 3576 set thread context of 6092 3576 spoolsv.exe 177 PID 1620 set thread context of 6000 1620 spoolsv.exe 176 PID 4684 set thread context of 1452 4684 spoolsv.exe 178 PID 3596 set thread context of 2092 3596 spoolsv.exe 179 PID 3764 set thread context of 6032 3764 spoolsv.exe 181 PID 860 set thread context of 5212 860 spoolsv.exe 182 PID 5476 set thread context of 5168 5476 spoolsv.exe 184 PID 5196 set thread context of 3456 5196 spoolsv.exe 185 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1840 0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe 1840 0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1740 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1840 0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe 1840 0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 1740 explorer.exe 3984 spoolsv.exe 3984 spoolsv.exe 5216 spoolsv.exe 5216 spoolsv.exe 5348 spoolsv.exe 5348 spoolsv.exe 5444 spoolsv.exe 5444 spoolsv.exe 5600 spoolsv.exe 5600 spoolsv.exe 5668 spoolsv.exe 5668 spoolsv.exe 5772 spoolsv.exe 5772 spoolsv.exe 2856 spoolsv.exe 2856 spoolsv.exe 5872 spoolsv.exe 5872 spoolsv.exe 5912 spoolsv.exe 5912 spoolsv.exe 6028 spoolsv.exe 6028 spoolsv.exe 1480 spoolsv.exe 1480 spoolsv.exe 5156 spoolsv.exe 5156 spoolsv.exe 5236 spoolsv.exe 5236 spoolsv.exe 5268 spoolsv.exe 5268 spoolsv.exe 5392 spoolsv.exe 5392 spoolsv.exe 5352 spoolsv.exe 5556 spoolsv.exe 5520 spoolsv.exe 5352 spoolsv.exe 5556 spoolsv.exe 5520 spoolsv.exe 5624 spoolsv.exe 3992 spoolsv.exe 5624 spoolsv.exe 3992 spoolsv.exe 1536 spoolsv.exe 4716 spoolsv.exe 5816 spoolsv.exe 1536 spoolsv.exe 5816 spoolsv.exe 4716 spoolsv.exe 3088 spoolsv.exe 5968 spoolsv.exe 3088 spoolsv.exe 5968 spoolsv.exe 6092 spoolsv.exe 1452 spoolsv.exe 6000 spoolsv.exe 2092 spoolsv.exe 6092 spoolsv.exe 6000 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 764 2236 0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe 86 PID 2236 wrote to memory of 764 2236 0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe 86 PID 2236 wrote to memory of 1840 2236 0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe 100 PID 2236 wrote to memory of 1840 2236 0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe 100 PID 2236 wrote to memory of 1840 2236 0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe 100 PID 2236 wrote to memory of 1840 2236 0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe 100 PID 2236 wrote to memory of 1840 2236 0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe 100 PID 1840 wrote to memory of 1316 1840 0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe 101 PID 1840 wrote to memory of 1316 1840 0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe 101 PID 1840 wrote to memory of 1316 1840 0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe 101 PID 1316 wrote to memory of 1740 1316 explorer.exe 105 PID 1316 wrote to memory of 1740 1316 explorer.exe 105 PID 1316 wrote to memory of 1740 1316 explorer.exe 105 PID 1316 wrote to memory of 1740 1316 explorer.exe 105 PID 1316 wrote to memory of 1740 1316 explorer.exe 105 PID 1740 wrote to memory of 4680 1740 explorer.exe 106 PID 1740 wrote to memory of 4680 1740 explorer.exe 106 PID 1740 wrote to memory of 4680 1740 explorer.exe 106 PID 1740 wrote to memory of 4040 1740 explorer.exe 107 PID 1740 wrote to memory of 4040 1740 explorer.exe 107 PID 1740 wrote to memory of 4040 1740 explorer.exe 107 PID 1740 wrote to memory of 4876 1740 explorer.exe 108 PID 1740 wrote to memory of 4876 1740 explorer.exe 108 PID 1740 wrote to memory of 4876 1740 explorer.exe 108 PID 1740 wrote to memory of 1140 1740 explorer.exe 109 PID 1740 wrote to memory of 1140 1740 explorer.exe 109 PID 1740 wrote to memory of 1140 1740 explorer.exe 109 PID 1740 wrote to memory of 3428 1740 explorer.exe 110 PID 1740 wrote to memory of 3428 1740 explorer.exe 110 PID 1740 wrote to memory of 3428 1740 explorer.exe 110 PID 1740 wrote to memory of 4788 1740 explorer.exe 111 PID 1740 wrote to memory of 4788 1740 explorer.exe 111 PID 1740 wrote to memory of 4788 1740 explorer.exe 111 PID 1740 wrote to memory of 4284 1740 explorer.exe 112 PID 1740 wrote to memory of 4284 1740 explorer.exe 112 PID 1740 wrote to memory of 4284 1740 explorer.exe 112 PID 1740 wrote to memory of 4496 1740 explorer.exe 114 PID 1740 wrote to memory of 4496 1740 explorer.exe 114 PID 1740 wrote to memory of 4496 1740 explorer.exe 114 PID 1740 wrote to memory of 3876 1740 explorer.exe 115 PID 1740 wrote to memory of 3876 1740 explorer.exe 115 PID 1740 wrote to memory of 3876 1740 explorer.exe 115 PID 1740 wrote to memory of 2776 1740 explorer.exe 116 PID 1740 wrote to memory of 2776 1740 explorer.exe 116 PID 1740 wrote to memory of 2776 1740 explorer.exe 116 PID 1740 wrote to memory of 2852 1740 explorer.exe 117 PID 1740 wrote to memory of 2852 1740 explorer.exe 117 PID 1740 wrote to memory of 2852 1740 explorer.exe 117 PID 1740 wrote to memory of 1916 1740 explorer.exe 119 PID 1740 wrote to memory of 1916 1740 explorer.exe 119 PID 1740 wrote to memory of 1916 1740 explorer.exe 119 PID 1740 wrote to memory of 1664 1740 explorer.exe 120 PID 1740 wrote to memory of 1664 1740 explorer.exe 120 PID 1740 wrote to memory of 1664 1740 explorer.exe 120 PID 1740 wrote to memory of 2692 1740 explorer.exe 121 PID 1740 wrote to memory of 2692 1740 explorer.exe 121 PID 1740 wrote to memory of 2692 1740 explorer.exe 121 PID 1740 wrote to memory of 4148 1740 explorer.exe 122 PID 1740 wrote to memory of 4148 1740 explorer.exe 122 PID 1740 wrote to memory of 4148 1740 explorer.exe 122 PID 1740 wrote to memory of 5024 1740 explorer.exe 123 PID 1740 wrote to memory of 5024 1740 explorer.exe 123 PID 1740 wrote to memory of 5024 1740 explorer.exe 123 PID 1740 wrote to memory of 2440 1740 explorer.exe 124
Processes
-
C:\Users\Admin\AppData\Local\Temp\0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:764
-
-
C:\Users\Admin\AppData\Local\Temp\0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0056bfc2ee49646d65fc5dc2788cc0f8_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4680 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3984 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5176
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4040 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5216
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4876 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5348
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1140 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5444
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3428 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5600
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4788 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5668
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4284 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5772
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4496 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2856
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3876 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5872
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2776 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5912
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2852 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6028
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1916 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1480
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1664 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5156
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2692 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5236
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4148 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5268
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5024 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5392
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2440 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5556
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4892 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5352
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3220 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5520
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3852 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5624
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1464 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3992
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2756 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1536
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1448 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5816
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4940 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:5968
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2356 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3088 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1800
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1620 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:6000
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3576 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:6092
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3596 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2092
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4684 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1452
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:860 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5212
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3764 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:6032
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5196 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3456
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5476 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:5168
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5740 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4716
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6140
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:5860
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
PID:5552
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5324
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:8
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4824
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5680
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3264
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3568
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1812
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2328
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4956
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5908
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5900
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2112
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5844
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2120
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5952
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2872
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4708
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5848
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3328
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5496
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5820
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6036
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5836
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1316
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5112
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5140
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5560
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4172
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:6124
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2784
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5528
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4152
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3812
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2652
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3056
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1528
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5808
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5728
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5464
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3488
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:220
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5264
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:888
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5396
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:5328
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6312
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:6588
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6860
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4144
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6432
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6744
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:7136
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:6344
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:6692
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:7036
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6460
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:6984
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6160
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3468
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:5756
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6584
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:7064
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6668
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6168
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:7020
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6380
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:7100
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1488
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:6272
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6620
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:6492
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:7128
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:7552
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:7880
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:8172
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:7664
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:8012
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:7524
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:7868
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:7456
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:7788
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:8160
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3232
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD534d3c042ba5837d7cb892960eaeb68b3
SHA15d19eea223c44525f9580bad30c511bcd105e0a7
SHA256f514af7486fd76a2bffe766c5a84a525fe2103877b26f42c44c58e1a02a03106
SHA512fb4fb69266e382c3c637abfb71f55b04a8768a033cf40922c18b33c1681b82f39506a07a35cd898d6a3acd8ea296c3a99002a27bbb423d748bb83da06a38fe0e
-
Filesize
2.2MB
MD56e01fcc07ca2c11dcdb918941c348a94
SHA1330e27a9ad4c005b4065bba346e91a483a2a491d
SHA256f0ea6274cc02c8c2b29ce1f029e1575cc2ff6bbdc1d27b5a26fedef7ce10161d
SHA51221b4972ad5afa20c840acfa60776f7cc09e4eaf59b8be0b249066870691831d1c60cb3bc93afd2dddb6768a21e7554f32c04ab24655c13f62807b84dc313780f