Analysis
-
max time kernel
146s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 05:10
Behavioral task
behavioral1
Sample
0471302a5727045c85e9f584f528b148_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
0471302a5727045c85e9f584f528b148_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
0471302a5727045c85e9f584f528b148
-
SHA1
b1f2c557df3595bdaa0d3e5a646f85e7f6ab370e
-
SHA256
4aae5086ec27b24590c37f5d07e365527a5f07b9819bb54052631f6d4757c431
-
SHA512
67c433cd708997e032c194634939a3024985bb4b7d6f1260bf1080800f51554a430f7195faf07cfb166e1ed8143caaaeec6ce24572703d2bac34c2216e6c9130
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZg:0UzeyQMS4DqodCnoe+iitjWwwc
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
0471302a5727045c85e9f584f528b148_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2428 explorer.exe 1604 explorer.exe 1680 spoolsv.exe 2808 spoolsv.exe 2828 spoolsv.exe 1140 spoolsv.exe 1328 spoolsv.exe 2032 spoolsv.exe 1844 spoolsv.exe 2616 spoolsv.exe 2120 spoolsv.exe 1544 spoolsv.exe 2108 spoolsv.exe 300 spoolsv.exe 1288 spoolsv.exe 2712 spoolsv.exe 2988 spoolsv.exe 2640 spoolsv.exe 2532 spoolsv.exe 1832 spoolsv.exe 2876 spoolsv.exe 1624 spoolsv.exe 1560 spoolsv.exe 980 spoolsv.exe 2492 spoolsv.exe 2444 spoolsv.exe 2376 spoolsv.exe 2820 spoolsv.exe 832 spoolsv.exe 900 spoolsv.exe 888 spoolsv.exe 992 spoolsv.exe 2632 spoolsv.exe 1376 spoolsv.exe 948 spoolsv.exe 1728 spoolsv.exe 2000 spoolsv.exe 2540 spoolsv.exe 3036 spoolsv.exe 2724 spoolsv.exe 1660 spoolsv.exe 1732 spoolsv.exe 2504 spoolsv.exe 2836 spoolsv.exe 2008 spoolsv.exe 1488 spoolsv.exe 2976 spoolsv.exe 2524 spoolsv.exe 2676 spoolsv.exe 1664 spoolsv.exe 2012 spoolsv.exe 2452 spoolsv.exe 944 spoolsv.exe 1412 spoolsv.exe 2560 spoolsv.exe 2708 spoolsv.exe 2792 spoolsv.exe 2912 spoolsv.exe 912 spoolsv.exe 1256 spoolsv.exe 352 spoolsv.exe 1716 spoolsv.exe 2436 spoolsv.exe 2216 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
0471302a5727045c85e9f584f528b148_JaffaCakes118.exeexplorer.exepid process 2740 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 2740 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
0471302a5727045c85e9f584f528b148_JaffaCakes118.exeexplorer.exedescription pid process target process PID 1956 set thread context of 2740 1956 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe PID 2428 set thread context of 1604 2428 explorer.exe explorer.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0471302a5727045c85e9f584f528b148_JaffaCakes118.exeexplorer.exepid process 2740 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1604 explorer.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
0471302a5727045c85e9f584f528b148_JaffaCakes118.exeexplorer.exepid process 2740 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 2740 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0471302a5727045c85e9f584f528b148_JaffaCakes118.exe0471302a5727045c85e9f584f528b148_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 1956 wrote to memory of 2132 1956 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe splwow64.exe PID 1956 wrote to memory of 2132 1956 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe splwow64.exe PID 1956 wrote to memory of 2132 1956 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe splwow64.exe PID 1956 wrote to memory of 2132 1956 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe splwow64.exe PID 1956 wrote to memory of 2740 1956 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe PID 1956 wrote to memory of 2740 1956 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe PID 1956 wrote to memory of 2740 1956 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe PID 1956 wrote to memory of 2740 1956 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe PID 1956 wrote to memory of 2740 1956 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe PID 1956 wrote to memory of 2740 1956 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe PID 2740 wrote to memory of 2428 2740 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe explorer.exe PID 2740 wrote to memory of 2428 2740 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe explorer.exe PID 2740 wrote to memory of 2428 2740 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe explorer.exe PID 2740 wrote to memory of 2428 2740 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe explorer.exe PID 2428 wrote to memory of 1604 2428 explorer.exe explorer.exe PID 2428 wrote to memory of 1604 2428 explorer.exe explorer.exe PID 2428 wrote to memory of 1604 2428 explorer.exe explorer.exe PID 2428 wrote to memory of 1604 2428 explorer.exe explorer.exe PID 2428 wrote to memory of 1604 2428 explorer.exe explorer.exe PID 2428 wrote to memory of 1604 2428 explorer.exe explorer.exe PID 1604 wrote to memory of 1680 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 1680 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 1680 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 1680 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2808 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2808 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2808 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2808 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2828 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2828 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2828 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2828 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 1140 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 1140 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 1140 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 1140 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 1328 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 1328 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 1328 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 1328 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2032 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2032 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2032 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2032 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 1844 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 1844 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 1844 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 1844 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2616 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2616 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2616 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2616 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2120 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2120 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2120 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2120 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 1544 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 1544 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 1544 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 1544 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2108 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2108 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2108 1604 explorer.exe spoolsv.exe PID 1604 wrote to memory of 2108 1604 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0471302a5727045c85e9f584f528b148_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0471302a5727045c85e9f584f528b148_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\0471302a5727045c85e9f584f528b148_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0471302a5727045c85e9f584f528b148_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\system\explorer.exeFilesize
2.2MB
MD55094ba4655e51d802a7a8f9cc7719074
SHA1e8a3b85febd3491c65734749a6d0978594ca30ae
SHA2562b978ef3bef51f67a8f6240938d13eb259b115ef79fa07f0bc224cddf21fa1d2
SHA512ec97d0440f518dd23e7cee3c900495eb74dcb34f444c0abc6f499bc54a24da061eadc496e26aa2a595905510b74a43e40f5d0f24d8b839f8c5dba276dc34330a
-
\Windows\system\spoolsv.exeFilesize
2.2MB
MD569cf3106c91c641f1baa303cd72679cc
SHA1ff807fc89ba809cd07ff2cabe8b27a484d375529
SHA2565e5ecf811b2598766e44abee5a7d23f4d6fedc24ab72d9b3df0d028d206639d9
SHA5127af4c5fd7c390e47a63eb8fabaddc4f124247289e1a70b515eb8a1763840026f99e59781e705c2a8dea1050658f63d987fb99b6b4c0c04c9419a82cb8295640b
-
memory/300-3296-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/832-3757-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/888-3759-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/900-3758-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/980-3306-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/992-3760-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1140-2754-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1288-3297-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1328-2755-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1544-3294-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1560-3305-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1604-2745-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1624-3304-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1680-2751-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1832-3302-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1844-2775-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1956-28-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1956-19-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1956-17-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1956-0-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2032-2757-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2108-3295-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2120-3293-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2376-3755-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2428-72-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2428-64-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2428-62-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2428-42-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2444-3754-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2492-3307-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2532-3301-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2616-3292-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2640-3300-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2712-3298-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2740-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2740-24-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2740-51-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2740-49-0x0000000000440000-0x00000000004A7000-memory.dmpFilesize
412KB
-
memory/2740-20-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2740-29-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2808-2752-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2820-3756-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2828-2753-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2876-3303-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2988-3299-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4244-5917-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4796-5907-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5676-5943-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB