pony | 10643ff07ca5d69480b2927c2137ff3209a5449050effc503af4972fbca56a96

Analysis

max time kernel
128s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe
Size

2.2MB
MD5

284b4326922eee47da41fe4df8f01b77
SHA1

074f191e3bc479f4de49c77e8947b1d1a70017ad
SHA256

10643ff07ca5d69480b2927c2137ff3209a5449050effc503af4972fbca56a96
SHA512

be1b4ecc05593b7be6b324f9aa8b4210f67d49d519f45380a8b46440d671d39a583145958733c122b5c6205a7fcf45bd28157f9948e9a6f06243cc1f160999b7
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZy:0UzeyQMS4DqodCnoe+iitjWww+

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe	284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe	284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
5040	explorer.exe
4076	explorer.exe
1476	spoolsv.exe
4768	spoolsv.exe
1588	spoolsv.exe
3836	spoolsv.exe
3588	spoolsv.exe
2888	spoolsv.exe
4300	spoolsv.exe
1340	spoolsv.exe
1736	spoolsv.exe
748	spoolsv.exe
4936	spoolsv.exe
4284	spoolsv.exe
1792	spoolsv.exe
3872	spoolsv.exe
8	spoolsv.exe
1072	spoolsv.exe
4276	spoolsv.exe
4560	spoolsv.exe
4084	spoolsv.exe
2064	spoolsv.exe
4596	spoolsv.exe
2108	spoolsv.exe
5076	spoolsv.exe
1956	spoolsv.exe
4992	spoolsv.exe
4632	spoolsv.exe
1752	spoolsv.exe
4412	spoolsv.exe
4500	explorer.exe
392	spoolsv.exe
5056	spoolsv.exe
4472	spoolsv.exe
1484	explorer.exe
1872	spoolsv.exe
3480	spoolsv.exe
2808	spoolsv.exe
2664	spoolsv.exe
4972	spoolsv.exe
1816	spoolsv.exe
4448	spoolsv.exe
4392	spoolsv.exe
4960	explorer.exe
1968	spoolsv.exe
4948	spoolsv.exe
3844	spoolsv.exe
1516	spoolsv.exe
5100	explorer.exe
3644	spoolsv.exe
5016	spoolsv.exe
1464	spoolsv.exe
2900	spoolsv.exe
2476	explorer.exe
2464	spoolsv.exe
4592	spoolsv.exe
1532	spoolsv.exe
4812	spoolsv.exe
2592	explorer.exe
1880	spoolsv.exe
5068	spoolsv.exe
2716	spoolsv.exe
1408	spoolsv.exe
2816	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 37 IoCs

description	pid	Process	procid_target
PID 916 set thread context of 4528	916	284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe	87
PID 5040 set thread context of 4076	5040	explorer.exe	90
PID 1476 set thread context of 4412	1476	spoolsv.exe	118
PID 4768 set thread context of 5056	4768	spoolsv.exe	121
PID 1588 set thread context of 4472	1588	spoolsv.exe	122
PID 3836 set thread context of 1872	3836	spoolsv.exe	124
PID 3588 set thread context of 3480	3588	spoolsv.exe	125
PID 2888 set thread context of 2808	2888	spoolsv.exe	126
PID 4300 set thread context of 4972	4300	spoolsv.exe	128
PID 1340 set thread context of 1816	1340	spoolsv.exe	129
PID 1736 set thread context of 4392	1736	spoolsv.exe	131
PID 748 set thread context of 1968	748	spoolsv.exe	133
PID 4936 set thread context of 4948	4936	spoolsv.exe	134
PID 4284 set thread context of 1516	4284	spoolsv.exe	136
PID 1792 set thread context of 3644	1792	spoolsv.exe	138
PID 3872 set thread context of 1464	3872	spoolsv.exe	140
PID 8 set thread context of 2900	8	spoolsv.exe	141
PID 1072 set thread context of 2464	1072	spoolsv.exe	143
PID 4276 set thread context of 1532	4276	spoolsv.exe	145
PID 4560 set thread context of 4812	4560	spoolsv.exe	146
PID 4084 set thread context of 1880	4084	spoolsv.exe	148
PID 2064 set thread context of 5068	2064	spoolsv.exe	149
PID 4596 set thread context of 1408	4596	spoolsv.exe	151
PID 2108 set thread context of 2816	2108	spoolsv.exe	152
PID 5076 set thread context of 4848	5076	spoolsv.exe	153
PID 1956 set thread context of 3824	1956	spoolsv.exe	155
PID 4992 set thread context of 1788	4992	spoolsv.exe	157
PID 4632 set thread context of 2308	4632	spoolsv.exe	158
PID 1752 set thread context of 1996	1752	spoolsv.exe	160
PID 4500 set thread context of 4844	4500	explorer.exe	163
PID 392 set thread context of 1396	392	spoolsv.exe	166
PID 1484 set thread context of 4664	1484	explorer.exe	170
PID 2664 set thread context of 4852	2664	spoolsv.exe	171
PID 4448 set thread context of 4552	4448	spoolsv.exe	179
PID 4960 set thread context of 2976	4960	explorer.exe	181
PID 3844 set thread context of 2228	3844	spoolsv.exe	184
PID 5100 set thread context of 4840	5100	explorer.exe	186

Drops file in Windows directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4528	284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe
4528	284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4528	284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe
4528	284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4076	explorer.exe
4412	spoolsv.exe
4412	spoolsv.exe
5056	spoolsv.exe
5056	spoolsv.exe
4472	spoolsv.exe
4472	spoolsv.exe
1872	spoolsv.exe
1872	spoolsv.exe
3480	spoolsv.exe
3480	spoolsv.exe
2808	spoolsv.exe
2808	spoolsv.exe
4972	spoolsv.exe
4972	spoolsv.exe
1816	spoolsv.exe
1816	spoolsv.exe
4392	spoolsv.exe
4392	spoolsv.exe
1968	spoolsv.exe
1968	spoolsv.exe
4948	spoolsv.exe
4948	spoolsv.exe
1516	spoolsv.exe
1516	spoolsv.exe
3644	spoolsv.exe
3644	spoolsv.exe
1464	spoolsv.exe
1464	spoolsv.exe
2900	spoolsv.exe
2900	spoolsv.exe
2464	spoolsv.exe
2464	spoolsv.exe
1532	spoolsv.exe
1532	spoolsv.exe
4812	spoolsv.exe
4812	spoolsv.exe
1880	spoolsv.exe
1880	spoolsv.exe
5068	spoolsv.exe
5068	spoolsv.exe
1408	spoolsv.exe
1408	spoolsv.exe
2816	spoolsv.exe
2816	spoolsv.exe
4848	spoolsv.exe
4848	spoolsv.exe
3824	spoolsv.exe
3824	spoolsv.exe
1788	spoolsv.exe
1788	spoolsv.exe
2308	spoolsv.exe
2308	spoolsv.exe
1996	spoolsv.exe
1996	spoolsv.exe
4844	explorer.exe
4844	explorer.exe
1396	spoolsv.exe
1396	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 696	916	284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe	81
PID 916 wrote to memory of 696	916	284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe	81
PID 916 wrote to memory of 4528	916	284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe	87
PID 916 wrote to memory of 4528	916	284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe	87
PID 916 wrote to memory of 4528	916	284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe	87
PID 916 wrote to memory of 4528	916	284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe	87
PID 916 wrote to memory of 4528	916	284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe	87
PID 4528 wrote to memory of 5040	4528	284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe	88
PID 4528 wrote to memory of 5040	4528	284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe	88
PID 4528 wrote to memory of 5040	4528	284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe	88
PID 5040 wrote to memory of 4076	5040	explorer.exe	90
PID 5040 wrote to memory of 4076	5040	explorer.exe	90
PID 5040 wrote to memory of 4076	5040	explorer.exe	90
PID 5040 wrote to memory of 4076	5040	explorer.exe	90
PID 5040 wrote to memory of 4076	5040	explorer.exe	90
PID 4076 wrote to memory of 1476	4076	explorer.exe	91
PID 4076 wrote to memory of 1476	4076	explorer.exe	91
PID 4076 wrote to memory of 1476	4076	explorer.exe	91
PID 4076 wrote to memory of 4768	4076	explorer.exe	92
PID 4076 wrote to memory of 4768	4076	explorer.exe	92
PID 4076 wrote to memory of 4768	4076	explorer.exe	92
PID 4076 wrote to memory of 1588	4076	explorer.exe	93
PID 4076 wrote to memory of 1588	4076	explorer.exe	93
PID 4076 wrote to memory of 1588	4076	explorer.exe	93
PID 4076 wrote to memory of 3836	4076	explorer.exe	94
PID 4076 wrote to memory of 3836	4076	explorer.exe	94
PID 4076 wrote to memory of 3836	4076	explorer.exe	94
PID 4076 wrote to memory of 3588	4076	explorer.exe	95
PID 4076 wrote to memory of 3588	4076	explorer.exe	95
PID 4076 wrote to memory of 3588	4076	explorer.exe	95
PID 4076 wrote to memory of 2888	4076	explorer.exe	96
PID 4076 wrote to memory of 2888	4076	explorer.exe	96
PID 4076 wrote to memory of 2888	4076	explorer.exe	96
PID 4076 wrote to memory of 4300	4076	explorer.exe	97
PID 4076 wrote to memory of 4300	4076	explorer.exe	97
PID 4076 wrote to memory of 4300	4076	explorer.exe	97
PID 4076 wrote to memory of 1340	4076	explorer.exe	98
PID 4076 wrote to memory of 1340	4076	explorer.exe	98
PID 4076 wrote to memory of 1340	4076	explorer.exe	98
PID 4076 wrote to memory of 1736	4076	explorer.exe	99
PID 4076 wrote to memory of 1736	4076	explorer.exe	99
PID 4076 wrote to memory of 1736	4076	explorer.exe	99
PID 4076 wrote to memory of 748	4076	explorer.exe	100
PID 4076 wrote to memory of 748	4076	explorer.exe	100
PID 4076 wrote to memory of 748	4076	explorer.exe	100
PID 4076 wrote to memory of 4936	4076	explorer.exe	101
PID 4076 wrote to memory of 4936	4076	explorer.exe	101
PID 4076 wrote to memory of 4936	4076	explorer.exe	101
PID 4076 wrote to memory of 4284	4076	explorer.exe	102
PID 4076 wrote to memory of 4284	4076	explorer.exe	102
PID 4076 wrote to memory of 4284	4076	explorer.exe	102
PID 4076 wrote to memory of 1792	4076	explorer.exe	103
PID 4076 wrote to memory of 1792	4076	explorer.exe	103
PID 4076 wrote to memory of 1792	4076	explorer.exe	103
PID 4076 wrote to memory of 3872	4076	explorer.exe	104
PID 4076 wrote to memory of 3872	4076	explorer.exe	104
PID 4076 wrote to memory of 3872	4076	explorer.exe	104
PID 4076 wrote to memory of 8	4076	explorer.exe	105
PID 4076 wrote to memory of 8	4076	explorer.exe	105
PID 4076 wrote to memory of 8	4076	explorer.exe	105
PID 4076 wrote to memory of 1072	4076	explorer.exe	106
PID 4076 wrote to memory of 1072	4076	explorer.exe	106
PID 4076 wrote to memory of 1072	4076	explorer.exe	106
PID 4076 wrote to memory of 4276	4076	explorer.exe	107

C:\Users\Admin\AppData\Local\Temp\284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:696
- C:\Users\Admin\AppData\Local\Temp\284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\284b4326922eee47da41fe4df8f01b77_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4528
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1476
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4412
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4500
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1588
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4472
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1484
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3588
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2888
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4300
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1340
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1736
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4392
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4960
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4284
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1516
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5100
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:8
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2900
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2476
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1072
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4276
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4812
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2592
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4084
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4848
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4356
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4632
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1752
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1996
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1592
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1396
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2516
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2664
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4852
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1984
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4552
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3844
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2228
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4476
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4592
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4524
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2716
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4420
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3312
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4468
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2232
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3108
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1568
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1404
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3524
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4876
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:180
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1268
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
ca253c3c6eb3b5da9331ae9a84836f26

SHA1
aa6763df7247786f0897f79ef93afbd72a90b865

SHA256
b5412db0c82c6fba66e6a380c97b27260c9b9c61d315f8b2439ec458ddcc83f0

SHA512
f5685cc2c0999eab461efb5f0513071ed89f0584019dcf137fd2f6cf5cb6a75be4b1ec7ea2c044639753e5b477f995416a5232cc7b3b03560186c220cffcfb39

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
5f6e2f6736c66d5317a1c81eb1e9afe0

SHA1
62b5c73dc46eb7e32205577189467565296a8a96

SHA256
ace794bc765ad385fba2f3a734f2df0706d7d7c1938f949e19c3799adbe68cb5

SHA512
828b88bb536d95f122d8d067acb8d5abf8afc2a04eb7132864851673bcbd950a81b52399677dcd7edadb6e8d996f4a3511b24e28e892db1a4461a8b585f9e76d

Download Submit
memory/8-1683-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/180-5070-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/748-1358-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/916-47-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/916-0-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/916-43-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/916-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1072-1684-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1332-4579-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1340-1174-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1396-3390-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1396-3286-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1408-2705-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1464-2364-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1476-728-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1476-1767-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1516-2297-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1532-2552-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1568-5055-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1568-4931-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1588-1918-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1588-861-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1736-1357-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1788-2876-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1792-1488-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1816-2043-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1816-2039-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1824-4338-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1872-1926-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1880-2598-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1880-2601-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1968-2177-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1996-3008-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1996-3129-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2064-1916-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2228-3936-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2228-3818-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2308-2908-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2464-2444-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2808-1958-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2816-2731-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2888-1054-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2976-3627-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3108-4754-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3480-1937-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3588-1053-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3644-2305-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3824-2824-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3836-1929-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3836-1052-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3872-1682-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3972-4961-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4076-108-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4076-727-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4084-1843-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4276-1773-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4284-1487-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4300-1173-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4392-2277-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4412-1774-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4412-1867-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/4412-1889-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4420-4546-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4420-4432-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4452-4948-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4468-4721-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4472-2091-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4472-1917-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4476-4064-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4476-3956-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4524-4260-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4524-4187-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4528-46-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4528-44-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4528-98-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4552-3739-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4552-3618-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4560-1842-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4596-1928-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4664-3438-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4692-4006-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4768-860-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4768-1845-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4772-4938-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4812-2589-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4812-2776-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4840-3829-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4844-3086-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4844-3083-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4848-2794-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4848-2925-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4852-3440-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4852-3548-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4936-1359-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4948-2187-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4972-2029-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4996-4663-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4996-4668-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5040-109-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5040-104-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5056-1844-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5068-2611-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download