Analysis
-
max time kernel
79s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 12:32
Behavioral task
behavioral1
Sample
053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe
-
Size
2.6MB
-
MD5
053298dd49a8952b53e13823dc46c181
-
SHA1
678b46bfff69d097eb5b21b51d838881fdcf63e7
-
SHA256
34320d9d04c1818d2b89e0afbca76e76346ebf54f4d9dab1ca4e3201972c7b46
-
SHA512
ddef5c28e25bfe8e9f79085f109193d7cd94315a553561c6dcf558bf339b6867b611b9bca98d65f35a6fd691366d11f33fce394198f2e046e44e295233c88f13
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlO:86SIROiFJiwp0xlrlO
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
053298dd49a8952b53e13823dc46c181_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1380 explorer.exe 1068 explorer.exe 1904 explorer.exe 2432 spoolsv.exe 2908 spoolsv.exe 800 spoolsv.exe 2304 spoolsv.exe 584 spoolsv.exe 1724 spoolsv.exe 964 spoolsv.exe 692 spoolsv.exe 2076 spoolsv.exe 2444 spoolsv.exe 2192 spoolsv.exe 2028 spoolsv.exe 2480 spoolsv.exe 2380 spoolsv.exe 2884 spoolsv.exe 1916 spoolsv.exe 2704 spoolsv.exe 2684 spoolsv.exe 1664 spoolsv.exe 2164 spoolsv.exe 2544 spoolsv.exe 308 spoolsv.exe 912 spoolsv.exe 1888 spoolsv.exe 1732 spoolsv.exe 984 spoolsv.exe 1844 spoolsv.exe 676 spoolsv.exe 904 spoolsv.exe 1688 spoolsv.exe 2608 spoolsv.exe 2636 spoolsv.exe 2880 spoolsv.exe 1348 spoolsv.exe 2044 spoolsv.exe 2596 spoolsv.exe 2228 spoolsv.exe 1768 spoolsv.exe 1480 spoolsv.exe 2220 spoolsv.exe 2336 spoolsv.exe 1984 spoolsv.exe 2900 spoolsv.exe 2640 spoolsv.exe 2776 spoolsv.exe 2396 spoolsv.exe 1472 spoolsv.exe 2564 spoolsv.exe 2760 spoolsv.exe 1912 spoolsv.exe 896 spoolsv.exe 956 spoolsv.exe 1616 spoolsv.exe 2932 spoolsv.exe 1584 spoolsv.exe 2024 spoolsv.exe 2804 spoolsv.exe 2192 spoolsv.exe 2344 spoolsv.exe 2600 spoolsv.exe 1160 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
053298dd49a8952b53e13823dc46c181_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1696 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 1696 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 1904 explorer.exe 1904 explorer.exe 2432 spoolsv.exe 1904 explorer.exe 1904 explorer.exe 800 spoolsv.exe 1904 explorer.exe 1904 explorer.exe 584 spoolsv.exe 1904 explorer.exe 1904 explorer.exe 964 spoolsv.exe 1904 explorer.exe 1904 explorer.exe 2076 spoolsv.exe 1904 explorer.exe 1904 explorer.exe 2192 spoolsv.exe 1904 explorer.exe 1904 explorer.exe 2480 spoolsv.exe 1904 explorer.exe 1904 explorer.exe 2884 spoolsv.exe 1904 explorer.exe 1904 explorer.exe 2704 spoolsv.exe 1904 explorer.exe 1904 explorer.exe 1664 spoolsv.exe 1904 explorer.exe 1904 explorer.exe 2544 spoolsv.exe 1904 explorer.exe 1904 explorer.exe 912 spoolsv.exe 1904 explorer.exe 1904 explorer.exe 1732 spoolsv.exe 1904 explorer.exe 1904 explorer.exe 1844 spoolsv.exe 1904 explorer.exe 1904 explorer.exe 904 spoolsv.exe 1904 explorer.exe 1904 explorer.exe 2608 spoolsv.exe 1904 explorer.exe 1904 explorer.exe 2880 spoolsv.exe 1904 explorer.exe 1904 explorer.exe 2044 spoolsv.exe 1904 explorer.exe 1904 explorer.exe 2228 spoolsv.exe 1904 explorer.exe 1904 explorer.exe 1480 spoolsv.exe 1904 explorer.exe 1904 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe053298dd49a8952b53e13823dc46c181_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 2892 set thread context of 2096 2892 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 2096 set thread context of 1696 2096 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 1380 set thread context of 1068 1380 explorer.exe explorer.exe PID 1068 set thread context of 1904 1068 explorer.exe explorer.exe PID 2432 set thread context of 2908 2432 spoolsv.exe spoolsv.exe PID 800 set thread context of 2304 800 spoolsv.exe spoolsv.exe PID 584 set thread context of 1724 584 spoolsv.exe spoolsv.exe PID 964 set thread context of 692 964 spoolsv.exe spoolsv.exe PID 2076 set thread context of 2444 2076 spoolsv.exe spoolsv.exe PID 2192 set thread context of 2028 2192 spoolsv.exe spoolsv.exe PID 2480 set thread context of 2380 2480 spoolsv.exe spoolsv.exe PID 2884 set thread context of 1916 2884 spoolsv.exe spoolsv.exe PID 2704 set thread context of 2684 2704 spoolsv.exe spoolsv.exe PID 1664 set thread context of 2164 1664 spoolsv.exe spoolsv.exe PID 2544 set thread context of 308 2544 spoolsv.exe spoolsv.exe PID 912 set thread context of 1888 912 spoolsv.exe spoolsv.exe PID 1732 set thread context of 984 1732 spoolsv.exe spoolsv.exe PID 1844 set thread context of 676 1844 spoolsv.exe spoolsv.exe PID 904 set thread context of 1688 904 spoolsv.exe spoolsv.exe PID 2608 set thread context of 2636 2608 spoolsv.exe spoolsv.exe PID 2880 set thread context of 1348 2880 spoolsv.exe spoolsv.exe PID 2044 set thread context of 2596 2044 spoolsv.exe spoolsv.exe PID 2228 set thread context of 1768 2228 spoolsv.exe spoolsv.exe PID 1480 set thread context of 2220 1480 spoolsv.exe spoolsv.exe PID 2336 set thread context of 1984 2336 spoolsv.exe spoolsv.exe PID 2900 set thread context of 2640 2900 spoolsv.exe spoolsv.exe PID 2776 set thread context of 2396 2776 spoolsv.exe spoolsv.exe PID 1472 set thread context of 2564 1472 spoolsv.exe spoolsv.exe PID 2760 set thread context of 1912 2760 spoolsv.exe spoolsv.exe PID 896 set thread context of 956 896 spoolsv.exe spoolsv.exe PID 1616 set thread context of 2932 1616 spoolsv.exe spoolsv.exe PID 1584 set thread context of 2024 1584 spoolsv.exe spoolsv.exe PID 2804 set thread context of 2192 2804 spoolsv.exe spoolsv.exe PID 2344 set thread context of 2600 2344 spoolsv.exe spoolsv.exe PID 1160 set thread context of 864 1160 spoolsv.exe spoolsv.exe PID 2032 set thread context of 2280 2032 spoolsv.exe spoolsv.exe PID 2452 set thread context of 2916 2452 spoolsv.exe spoolsv.exe PID 528 set thread context of 1836 528 spoolsv.exe spoolsv.exe PID 1956 set thread context of 2772 1956 spoolsv.exe spoolsv.exe PID 1928 set thread context of 2340 1928 spoolsv.exe spoolsv.exe PID 1492 set thread context of 2064 1492 spoolsv.exe spoolsv.exe PID 2132 set thread context of 1704 2132 spoolsv.exe spoolsv.exe PID 1744 set thread context of 1824 1744 spoolsv.exe spoolsv.exe PID 1944 set thread context of 1928 1944 spoolsv.exe spoolsv.exe PID 2796 set thread context of 2032 2796 spoolsv.exe spoolsv.exe PID 2556 set thread context of 2004 2556 spoolsv.exe spoolsv.exe PID 1736 set thread context of 2328 1736 spoolsv.exe spoolsv.exe PID 2132 set thread context of 2912 2132 spoolsv.exe spoolsv.exe PID 1104 set thread context of 1848 1104 spoolsv.exe spoolsv.exe PID 896 set thread context of 1992 896 spoolsv.exe spoolsv.exe PID 2992 set thread context of 2896 2992 spoolsv.exe spoolsv.exe PID 2480 set thread context of 2884 2480 spoolsv.exe spoolsv.exe PID 2704 set thread context of 2176 2704 spoolsv.exe spoolsv.exe PID 2972 set thread context of 364 2972 spoolsv.exe spoolsv.exe PID 368 set thread context of 3060 368 spoolsv.exe spoolsv.exe PID 2744 set thread context of 2316 2744 spoolsv.exe spoolsv.exe PID 2020 set thread context of 1736 2020 spoolsv.exe spoolsv.exe PID 1388 set thread context of 2568 1388 spoolsv.exe spoolsv.exe PID 3016 set thread context of 1728 3016 spoolsv.exe spoolsv.exe PID 2348 set thread context of 1972 2348 spoolsv.exe spoolsv.exe PID 2788 set thread context of 2668 2788 spoolsv.exe spoolsv.exe PID 1988 set thread context of 368 1988 spoolsv.exe spoolsv.exe PID 2872 set thread context of 1160 2872 spoolsv.exe spoolsv.exe PID 908 set thread context of 1576 908 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
053298dd49a8952b53e13823dc46c181_JaffaCakes118.exeexplorer.exepid process 1696 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe 1904 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1904 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe053298dd49a8952b53e13823dc46c181_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2892 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 1696 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 1696 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 1380 explorer.exe 1904 explorer.exe 1904 explorer.exe 2432 spoolsv.exe 1904 explorer.exe 1904 explorer.exe 800 spoolsv.exe 584 spoolsv.exe 964 spoolsv.exe 2076 spoolsv.exe 2192 spoolsv.exe 2480 spoolsv.exe 2884 spoolsv.exe 2704 spoolsv.exe 1664 spoolsv.exe 2544 spoolsv.exe 912 spoolsv.exe 1732 spoolsv.exe 1844 spoolsv.exe 904 spoolsv.exe 2608 spoolsv.exe 2880 spoolsv.exe 2044 spoolsv.exe 2228 spoolsv.exe 1480 spoolsv.exe 2336 spoolsv.exe 2900 spoolsv.exe 2776 spoolsv.exe 1472 spoolsv.exe 2760 spoolsv.exe 896 spoolsv.exe 1616 spoolsv.exe 1584 spoolsv.exe 2804 spoolsv.exe 2344 spoolsv.exe 1160 spoolsv.exe 2032 spoolsv.exe 2452 spoolsv.exe 528 spoolsv.exe 1956 spoolsv.exe 1928 spoolsv.exe 1492 spoolsv.exe 2132 spoolsv.exe 1744 spoolsv.exe 1944 spoolsv.exe 2796 spoolsv.exe 2556 spoolsv.exe 1736 spoolsv.exe 2132 spoolsv.exe 1104 spoolsv.exe 896 spoolsv.exe 2992 spoolsv.exe 2480 spoolsv.exe 2704 spoolsv.exe 2972 spoolsv.exe 368 spoolsv.exe 2744 spoolsv.exe 2020 spoolsv.exe 1388 spoolsv.exe 3016 spoolsv.exe 2348 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe053298dd49a8952b53e13823dc46c181_JaffaCakes118.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exedescription pid process target process PID 2892 wrote to memory of 2096 2892 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 2892 wrote to memory of 2096 2892 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 2892 wrote to memory of 2096 2892 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 2892 wrote to memory of 2096 2892 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 2892 wrote to memory of 2096 2892 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 2892 wrote to memory of 2096 2892 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 2892 wrote to memory of 2096 2892 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 2892 wrote to memory of 2096 2892 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 2892 wrote to memory of 2096 2892 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 2892 wrote to memory of 2096 2892 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 2892 wrote to memory of 2096 2892 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 2892 wrote to memory of 2096 2892 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 2892 wrote to memory of 2096 2892 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 2892 wrote to memory of 2096 2892 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 2096 wrote to memory of 2944 2096 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe splwow64.exe PID 2096 wrote to memory of 2944 2096 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe splwow64.exe PID 2096 wrote to memory of 2944 2096 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe splwow64.exe PID 2096 wrote to memory of 2944 2096 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe splwow64.exe PID 2096 wrote to memory of 1696 2096 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 2096 wrote to memory of 1696 2096 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 2096 wrote to memory of 1696 2096 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 2096 wrote to memory of 1696 2096 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 2096 wrote to memory of 1696 2096 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 2096 wrote to memory of 1696 2096 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe PID 1696 wrote to memory of 1380 1696 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe explorer.exe PID 1696 wrote to memory of 1380 1696 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe explorer.exe PID 1696 wrote to memory of 1380 1696 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe explorer.exe PID 1696 wrote to memory of 1380 1696 053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe explorer.exe PID 1380 wrote to memory of 1068 1380 explorer.exe explorer.exe PID 1380 wrote to memory of 1068 1380 explorer.exe explorer.exe PID 1380 wrote to memory of 1068 1380 explorer.exe explorer.exe PID 1380 wrote to memory of 1068 1380 explorer.exe explorer.exe PID 1380 wrote to memory of 1068 1380 explorer.exe explorer.exe PID 1380 wrote to memory of 1068 1380 explorer.exe explorer.exe PID 1380 wrote to memory of 1068 1380 explorer.exe explorer.exe PID 1380 wrote to memory of 1068 1380 explorer.exe explorer.exe PID 1380 wrote to memory of 1068 1380 explorer.exe explorer.exe PID 1380 wrote to memory of 1068 1380 explorer.exe explorer.exe PID 1380 wrote to memory of 1068 1380 explorer.exe explorer.exe PID 1380 wrote to memory of 1068 1380 explorer.exe explorer.exe PID 1380 wrote to memory of 1068 1380 explorer.exe explorer.exe PID 1380 wrote to memory of 1068 1380 explorer.exe explorer.exe PID 1068 wrote to memory of 1904 1068 explorer.exe explorer.exe PID 1068 wrote to memory of 1904 1068 explorer.exe explorer.exe PID 1068 wrote to memory of 1904 1068 explorer.exe explorer.exe PID 1068 wrote to memory of 1904 1068 explorer.exe explorer.exe PID 1068 wrote to memory of 1904 1068 explorer.exe explorer.exe PID 1068 wrote to memory of 1904 1068 explorer.exe explorer.exe PID 1904 wrote to memory of 2432 1904 explorer.exe spoolsv.exe PID 1904 wrote to memory of 2432 1904 explorer.exe spoolsv.exe PID 1904 wrote to memory of 2432 1904 explorer.exe spoolsv.exe PID 1904 wrote to memory of 2432 1904 explorer.exe spoolsv.exe PID 2432 wrote to memory of 2908 2432 spoolsv.exe spoolsv.exe PID 2432 wrote to memory of 2908 2432 spoolsv.exe spoolsv.exe PID 2432 wrote to memory of 2908 2432 spoolsv.exe spoolsv.exe PID 2432 wrote to memory of 2908 2432 spoolsv.exe spoolsv.exe PID 2432 wrote to memory of 2908 2432 spoolsv.exe spoolsv.exe PID 2432 wrote to memory of 2908 2432 spoolsv.exe spoolsv.exe PID 2432 wrote to memory of 2908 2432 spoolsv.exe spoolsv.exe PID 2432 wrote to memory of 2908 2432 spoolsv.exe spoolsv.exe PID 2432 wrote to memory of 2908 2432 spoolsv.exe spoolsv.exe PID 2432 wrote to memory of 2908 2432 spoolsv.exe spoolsv.exe PID 2432 wrote to memory of 2908 2432 spoolsv.exe spoolsv.exe PID 2432 wrote to memory of 2908 2432 spoolsv.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe"2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
C:\Users\Admin\AppData\Local\Temp\053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\053298dd49a8952b53e13823dc46c181_JaffaCakes118.exe"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\System32\spool\drivers\x64\3\mxdwdui.BUDFilesize
56KB
MD5bd72dcf1083b6e22ccbfa0e8e27fb1e0
SHA13fd23d4f14da768da7b8364d74c54932d704e74e
SHA25690f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1
SHA51272360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562
-
C:\Windows\system\explorer.exeFilesize
2.6MB
MD535eeb04fd74dcf4e9ff1bc614aea303f
SHA1412e15533d2e3ed05b79da0f2e8f03a59973be16
SHA25630f8077cd941e432e0adac839eb905f8649f0ca32626a4be0c1cf09483b5aa2a
SHA512011ba7eb83ae44d434ad9c3ad4e36c08d3bf1565e7dbafb6fcb5336d4c967afb074c3edc28f7a5efcc083325c5f7165c0e91a3f6036c708ebb3b128ad1498239
-
\Windows\system\spoolsv.exeFilesize
2.6MB
MD5e5f9786ee93b0c609e88a95e16ef4eb7
SHA138ab1b2df264260f869aef0f8f523cdee0449a4a
SHA256013d177eefc97b8640cb34df3ee9de010f9f240641034e2fb4b95648e33e1737
SHA51275497d3b03b549d36f25c2a83e5b0d5a00e7755f487e4ac2b36b630e12c598b64bf50e609fa2ca15b7ee7de73d6f7752ce1bf75b32ea730caccf55b0645a4159
-
memory/972-3717-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1068-91-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1068-81-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1068-64-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1068-60-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1380-58-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1380-55-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1696-32-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1696-28-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1696-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1696-38-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1696-63-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1716-3760-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1716-3858-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2096-7-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2096-4-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2096-39-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2096-8-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/2096-25-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2096-27-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/2096-3-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2096-5-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2440-3700-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2872-3631-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2892-6-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2892-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2908-110-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3204-3665-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3448-3739-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3448-3734-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3452-3565-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3452-3556-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3532-3644-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3532-3586-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3936-3560-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3936-3534-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3988-3614-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4284-3813-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4388-3778-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4712-3869-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB