pony | 98b8f94619fb2a3c4fcf069e53b158d019516d75b037185d660cbefc8e0d20ed

Analysis

max time kernel
116s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe
Size

2.2MB
MD5

056a71d77550b54ed91a2348388b58ce
SHA1

fb90dde80eacd6f5a32955f168e6342f1f77e60d
SHA256

98b8f94619fb2a3c4fcf069e53b158d019516d75b037185d660cbefc8e0d20ed
SHA512

eb6a09a3dcd0edd679ee7aa14c02baf600bb91a4a30ce7ae90ce5932e52b9feec20a85c0ff99173c28f9bc3fba75c4db0dd546a728948c8d2fd1cd79464924f5
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZL:0UzeyQMS4DqodCnoe+iitjWww3

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

Processes:

056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

Processes:

explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exe

pid	process
4776	explorer.exe
712	explorer.exe
4468	spoolsv.exe
2544	spoolsv.exe
3592	spoolsv.exe
3980	spoolsv.exe
4572	spoolsv.exe
4912	spoolsv.exe
2596	spoolsv.exe
1356	spoolsv.exe
3712	spoolsv.exe
5040	spoolsv.exe
4856	spoolsv.exe
884	spoolsv.exe
2020	spoolsv.exe
5056	spoolsv.exe
4988	spoolsv.exe
2040	spoolsv.exe
3284	spoolsv.exe
4028	spoolsv.exe
628	spoolsv.exe
4352	spoolsv.exe
3168	spoolsv.exe
4584	spoolsv.exe
2004	spoolsv.exe
3132	spoolsv.exe
3772	spoolsv.exe
2488	explorer.exe
368	spoolsv.exe
5092	spoolsv.exe
4984	explorer.exe
2712	spoolsv.exe
2472	spoolsv.exe
4688	spoolsv.exe
1896	spoolsv.exe
3176	explorer.exe
4200	spoolsv.exe
4068	spoolsv.exe
3276	spoolsv.exe
4348	spoolsv.exe
4320	explorer.exe
116	spoolsv.exe
3120	spoolsv.exe
5088	spoolsv.exe
5076	explorer.exe
2120	spoolsv.exe
3940	spoolsv.exe
1380	spoolsv.exe
2780	spoolsv.exe
1224	explorer.exe
4448	spoolsv.exe
3576	spoolsv.exe
4596	spoolsv.exe
1744	explorer.exe
4924	spoolsv.exe
3944	spoolsv.exe
3212	spoolsv.exe
4340	explorer.exe
2508	spoolsv.exe
2328	spoolsv.exe
1560	spoolsv.exe
2984	explorer.exe
4688	spoolsv.exe
3080	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Suspicious use of SetThreadContext 27 IoCs

Processes:

056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exe

description	pid	process	target process
PID 3860 set thread context of 1252	3860	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe
PID 4776 set thread context of 712	4776	explorer.exe	explorer.exe
PID 4468 set thread context of 3772	4468	spoolsv.exe	spoolsv.exe
PID 2544 set thread context of 5092	2544	spoolsv.exe	spoolsv.exe
PID 3592 set thread context of 2712	3592	spoolsv.exe	spoolsv.exe
PID 3980 set thread context of 4688	3980	spoolsv.exe	spoolsv.exe
PID 4572 set thread context of 1896	4572	spoolsv.exe	spoolsv.exe
PID 4912 set thread context of 4068	4912	spoolsv.exe	spoolsv.exe
PID 2596 set thread context of 4348	2596	spoolsv.exe	spoolsv.exe
PID 1356 set thread context of 3120	1356	spoolsv.exe	spoolsv.exe
PID 3712 set thread context of 5088	3712	spoolsv.exe	spoolsv.exe
PID 5040 set thread context of 3940	5040	spoolsv.exe	spoolsv.exe
PID 4856 set thread context of 2780	4856	spoolsv.exe	spoolsv.exe
PID 884 set thread context of 4448	884	spoolsv.exe	spoolsv.exe
PID 2020 set thread context of 4596	2020	spoolsv.exe	spoolsv.exe
PID 5056 set thread context of 4924	5056	spoolsv.exe	spoolsv.exe
PID 4988 set thread context of 3212	4988	spoolsv.exe	spoolsv.exe
PID 2040 set thread context of 2508	2040	spoolsv.exe	spoolsv.exe
PID 3284 set thread context of 1560	3284	spoolsv.exe	spoolsv.exe
PID 4028 set thread context of 4688	4028	spoolsv.exe	spoolsv.exe
PID 628 set thread context of 4436	628	spoolsv.exe	spoolsv.exe
PID 4352 set thread context of 3548	4352	spoolsv.exe	spoolsv.exe
PID 3168 set thread context of 3708	3168	spoolsv.exe	spoolsv.exe
PID 4584 set thread context of 4944	4584	spoolsv.exe	spoolsv.exe
PID 2004 set thread context of 3348	2004	spoolsv.exe	spoolsv.exe
PID 2488 set thread context of 736	2488	explorer.exe	explorer.exe
PID 3132 set thread context of 220	3132	spoolsv.exe	spoolsv.exe

Drops file in Windows directory 53 IoCs

Processes:

spoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exe056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exespoolsv.exespoolsv.exeexplorer.exe056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exe

description	ioc	process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exeexplorer.exe

pid	process
1252	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe
1252	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe

Suspicious use of SetWindowsHookEx 56 IoCs

Processes:

pid	process
1252	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe
1252	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
712	explorer.exe
3772	spoolsv.exe
3772	spoolsv.exe
5092	spoolsv.exe
5092	spoolsv.exe
2712	spoolsv.exe
2712	spoolsv.exe
4688	spoolsv.exe
4688	spoolsv.exe
1896	spoolsv.exe
1896	spoolsv.exe
4068	spoolsv.exe
4068	spoolsv.exe
4348	spoolsv.exe
4348	spoolsv.exe
3120	spoolsv.exe
3120	spoolsv.exe
5088	spoolsv.exe
5088	spoolsv.exe
3940	spoolsv.exe
3940	spoolsv.exe
2780	spoolsv.exe
2780	spoolsv.exe
4448	spoolsv.exe
4448	spoolsv.exe
4596	spoolsv.exe
4596	spoolsv.exe
4924	spoolsv.exe
4924	spoolsv.exe
3212	spoolsv.exe
3212	spoolsv.exe
2508	spoolsv.exe
2508	spoolsv.exe
1560	spoolsv.exe
1560	spoolsv.exe
4688	spoolsv.exe
4688	spoolsv.exe
4436	spoolsv.exe
4436	spoolsv.exe
3548	spoolsv.exe
3548	spoolsv.exe
3708	spoolsv.exe
3708	spoolsv.exe
4944	spoolsv.exe
4944	spoolsv.exe
3348	spoolsv.exe
3348	spoolsv.exe
736	explorer.exe
736	explorer.exe
220	spoolsv.exe
220	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exeexplorer.exeexplorer.exe

description	pid	process	target process
PID 3860 wrote to memory of 4080	3860	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe	splwow64.exe
PID 3860 wrote to memory of 4080	3860	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe	splwow64.exe
PID 3860 wrote to memory of 1252	3860	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe
PID 3860 wrote to memory of 1252	3860	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe
PID 3860 wrote to memory of 1252	3860	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe
PID 3860 wrote to memory of 1252	3860	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe
PID 3860 wrote to memory of 1252	3860	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe
PID 1252 wrote to memory of 4776	1252	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe	explorer.exe
PID 1252 wrote to memory of 4776	1252	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe	explorer.exe
PID 1252 wrote to memory of 4776	1252	056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe	explorer.exe
PID 4776 wrote to memory of 712	4776	explorer.exe	explorer.exe
PID 4776 wrote to memory of 712	4776	explorer.exe	explorer.exe
PID 4776 wrote to memory of 712	4776	explorer.exe	explorer.exe
PID 4776 wrote to memory of 712	4776	explorer.exe	explorer.exe
PID 4776 wrote to memory of 712	4776	explorer.exe	explorer.exe
PID 712 wrote to memory of 4468	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 4468	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 4468	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 2544	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 2544	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 2544	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 3592	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 3592	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 3592	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 3980	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 3980	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 3980	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 4572	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 4572	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 4572	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 4912	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 4912	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 4912	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 2596	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 2596	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 2596	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 1356	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 1356	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 1356	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 3712	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 3712	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 3712	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 5040	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 5040	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 5040	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 4856	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 4856	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 4856	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 884	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 884	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 884	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 2020	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 2020	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 2020	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 5056	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 5056	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 5056	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 4988	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 4988	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 4988	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 2040	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 2040	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 2040	712	explorer.exe	spoolsv.exe
PID 712 wrote to memory of 3284	712	explorer.exe	spoolsv.exe

C:\Users\Admin\AppData\Local\Temp\056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3860

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:4080

C:\Users\Admin\AppData\Local\Temp\056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\056a71d77550b54ed91a2348388b58ce_JaffaCakes118.exe"
2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4776

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:712

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4468

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3772

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2488

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
- Suspicious use of SetWindowsHookEx
PID:736

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2544

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5092

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4984

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:1276

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3592

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2712

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3980

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4688

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4572

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1896

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3176

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:536

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4912

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4068

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2596

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4348

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4320

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:4300

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1356

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3120

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3712

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5088

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5076

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:1336

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5040

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3940

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4856

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2780

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1224

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:4860

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:884

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4448

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2020

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4596

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1744

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:3236

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5056

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4924

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4988

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3212

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4340

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:3496

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2040

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2508

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3284

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1560

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2984

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:4848

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4028

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4688

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:628

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Suspicious use of SetWindowsHookEx
PID:4436

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Drops file in Windows directory
PID:4544

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:3728

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4352

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Suspicious use of SetWindowsHookEx
PID:3548

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3168

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Suspicious use of SetWindowsHookEx
PID:3708

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Drops file in Windows directory
PID:2084

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:4940

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4584

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Suspicious use of SetWindowsHookEx
PID:4944

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2004

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Suspicious use of SetWindowsHookEx
PID:3348

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3132

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Suspicious use of SetWindowsHookEx
PID:220

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Drops file in Windows directory
PID:3340

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:3780

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:368

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:8

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:4548

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:1632

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:2472

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:3700

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4200

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:1988

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:2908

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:4236

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3276

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:2036

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:116

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:4764

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:2800

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2120

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:4284

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1380

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:4336

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:936

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3576

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:4440

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:840

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3944

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:1280

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:4024

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2328

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:2440

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:1832

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3080

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:832

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:3948

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:3240

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:1672

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Drops file in Windows directory
PID:2920

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:1676

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:3940

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:4884

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:2844

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3740

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:2308

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:2784

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:5032

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:4500

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:384

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3584

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:5020

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:636

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:4316

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:4372

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:4600

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1172

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3916

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2888

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2304

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1760

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1536

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:532

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:4188

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2152

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\Parameters.ini
Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe
Filesize
2.2MB

MD5
67f222f8b7382109518655892cb4ab4d

SHA1
9974eca395af91488b9abd3a36c6ab4934f6cf0a

SHA256
9648c10eac45dc09e57e8b4f9fee1431ace09fe1f69326bd68cef760079f5acb

SHA512
ec5d182201c9d8f53c0661040adb3bc2500c7acfe9cad0abf74bf4fb93b3eb6836fea382e3613691b4c6b6225b4cdad072cad6258fdfb56e69bdeb943a21152c

Download Submit
C:\Windows\System\spoolsv.exe
Filesize
2.2MB

MD5
7698712ef6bdfc8e3a0105ffc2d5bfda

SHA1
7e9bfaa1e224abd82b02366c911eac464dd306b3

SHA256
44a1f755b89a0ba67c1d6e2a7705d29325c71715dae69cb72a693730c86e52b8

SHA512
70dc2f3a1d59b0508cdb48e3ff86514c6e1e8d5113f8b5117fa74decc63d79c9bfff1b9d2b1fcb2f0a19b9a643af4d9ce7413d50096f59b6e7e8ae9ba3ac5938

Download Submit
memory/8-3643-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/8-3478-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/220-3249-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/220-3363-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/536-3660-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/712-608-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/712-84-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/736-3244-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/832-4489-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/832-4485-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/884-1325-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1252-72-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/1252-31-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1252-74-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1252-29-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1276-3488-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1280-4352-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1336-3931-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1356-1108-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1560-2723-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1632-5161-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1676-4868-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1676-5005-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1896-1832-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1896-1891-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1988-3670-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1988-3827-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2020-1326-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2036-3680-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2040-1649-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2308-5033-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2440-4467-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2508-2609-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2544-727-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2544-1646-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2596-971-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2712-1659-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2780-2446-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2780-2326-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2844-4974-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3120-2043-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3212-2700-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3212-2600-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3236-4139-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3240-4716-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3284-1658-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3348-3153-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3496-4361-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3548-2891-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3548-2895-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3592-728-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3592-1657-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3700-3608-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3708-3048-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3708-3223-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3712-1109-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3728-4583-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3772-1565-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3772-1521-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3780-4878-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3860-0-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/3860-32-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3860-28-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/3860-26-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3940-2199-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3980-838-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3980-1731-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4028-1733-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4068-1872-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4236-5281-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4284-3942-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4284-3939-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4300-3765-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4336-4029-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4348-1959-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4436-3022-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4436-2883-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4440-4130-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4440-4251-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4448-2338-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4448-2333-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4468-1522-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4468-609-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4500-5212-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4572-1829-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4572-839-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4596-2582-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4596-2467-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4688-1734-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4688-2735-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4764-3910-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4764-3969-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4776-85-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4776-80-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4848-4476-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4856-1207-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4912-970-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4924-2477-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4940-4787-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4944-3058-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4988-1520-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5040-1206-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5056-1519-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5088-2127-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5092-1813-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5092-1650-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download