Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 04:00
Behavioral task
behavioral1
Sample
65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe
-
Size
2.6MB
-
MD5
65ef0c33a4ac9ffb39032f1383d726eb
-
SHA1
6fbc8387a6d8316da0c72917f3b339c3251ac50e
-
SHA256
b443fa8f455225e2c63c65f741f60cd6601331688f916c07722295d1e734f8a0
-
SHA512
5529727a175c21a9d2a9d0e79a3fd5b982f5ba462affb1861f833596c5bb65e11fe0e56ca824dbe5fb5d4303cd3d7f5a2013d280bff114d4a147bdecaa9eb92f
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlX:86SIROiFJiwp0xlrlX
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2592 explorer.exe 3064 explorer.exe 328 explorer.exe 1644 spoolsv.exe 2084 spoolsv.exe 2120 spoolsv.exe 1280 spoolsv.exe 696 spoolsv.exe 1988 spoolsv.exe 1780 spoolsv.exe 1660 spoolsv.exe 2312 spoolsv.exe 1056 spoolsv.exe 2424 spoolsv.exe 2068 spoolsv.exe 2664 spoolsv.exe 3020 spoolsv.exe 2636 spoolsv.exe 3028 spoolsv.exe 3048 spoolsv.exe 608 spoolsv.exe 1808 spoolsv.exe 1132 spoolsv.exe 2108 spoolsv.exe 1652 spoolsv.exe 2396 spoolsv.exe 1924 spoolsv.exe 1864 spoolsv.exe 2868 spoolsv.exe 832 spoolsv.exe 2064 spoolsv.exe 2816 spoolsv.exe 2808 spoolsv.exe 2680 spoolsv.exe 1684 spoolsv.exe 2636 spoolsv.exe 2200 spoolsv.exe 2732 spoolsv.exe 2864 spoolsv.exe 2960 spoolsv.exe 1008 spoolsv.exe 1136 spoolsv.exe 1848 spoolsv.exe 912 spoolsv.exe 1724 spoolsv.exe 1248 spoolsv.exe 3000 spoolsv.exe 2820 spoolsv.exe 2528 spoolsv.exe 2556 spoolsv.exe 2288 spoolsv.exe 1708 spoolsv.exe 1764 spoolsv.exe 2796 spoolsv.exe 980 spoolsv.exe 1332 spoolsv.exe 1796 spoolsv.exe 2928 spoolsv.exe 2220 spoolsv.exe 2596 spoolsv.exe 1928 spoolsv.exe 2628 spoolsv.exe 2872 spoolsv.exe 1868 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2060 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 2060 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 328 explorer.exe 328 explorer.exe 1644 spoolsv.exe 328 explorer.exe 328 explorer.exe 2120 spoolsv.exe 328 explorer.exe 328 explorer.exe 696 spoolsv.exe 328 explorer.exe 328 explorer.exe 1780 spoolsv.exe 328 explorer.exe 328 explorer.exe 2312 spoolsv.exe 328 explorer.exe 328 explorer.exe 2424 spoolsv.exe 328 explorer.exe 328 explorer.exe 2664 spoolsv.exe 328 explorer.exe 328 explorer.exe 2636 spoolsv.exe 328 explorer.exe 328 explorer.exe 3048 spoolsv.exe 328 explorer.exe 328 explorer.exe 1808 spoolsv.exe 328 explorer.exe 328 explorer.exe 2108 spoolsv.exe 328 explorer.exe 328 explorer.exe 2396 spoolsv.exe 328 explorer.exe 328 explorer.exe 1864 spoolsv.exe 328 explorer.exe 328 explorer.exe 832 spoolsv.exe 328 explorer.exe 328 explorer.exe 2816 spoolsv.exe 328 explorer.exe 328 explorer.exe 2680 spoolsv.exe 328 explorer.exe 328 explorer.exe 2636 spoolsv.exe 328 explorer.exe 328 explorer.exe 2732 spoolsv.exe 328 explorer.exe 328 explorer.exe 2960 spoolsv.exe 328 explorer.exe 328 explorer.exe 1136 spoolsv.exe 328 explorer.exe 328 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 1936 set thread context of 1228 1936 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 1228 set thread context of 2060 1228 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 2592 set thread context of 3064 2592 explorer.exe explorer.exe PID 3064 set thread context of 328 3064 explorer.exe explorer.exe PID 1644 set thread context of 2084 1644 spoolsv.exe spoolsv.exe PID 2120 set thread context of 1280 2120 spoolsv.exe spoolsv.exe PID 696 set thread context of 1988 696 spoolsv.exe spoolsv.exe PID 1780 set thread context of 1660 1780 spoolsv.exe spoolsv.exe PID 2312 set thread context of 1056 2312 spoolsv.exe spoolsv.exe PID 2424 set thread context of 2068 2424 spoolsv.exe spoolsv.exe PID 2664 set thread context of 3020 2664 spoolsv.exe spoolsv.exe PID 2636 set thread context of 3028 2636 spoolsv.exe spoolsv.exe PID 3048 set thread context of 608 3048 spoolsv.exe spoolsv.exe PID 1808 set thread context of 1132 1808 spoolsv.exe spoolsv.exe PID 2108 set thread context of 1652 2108 spoolsv.exe spoolsv.exe PID 2396 set thread context of 1924 2396 spoolsv.exe spoolsv.exe PID 1864 set thread context of 2868 1864 spoolsv.exe spoolsv.exe PID 832 set thread context of 2064 832 spoolsv.exe spoolsv.exe PID 2816 set thread context of 2808 2816 spoolsv.exe spoolsv.exe PID 2680 set thread context of 1684 2680 spoolsv.exe spoolsv.exe PID 2636 set thread context of 2200 2636 spoolsv.exe spoolsv.exe PID 2732 set thread context of 2864 2732 spoolsv.exe spoolsv.exe PID 2960 set thread context of 1008 2960 spoolsv.exe spoolsv.exe PID 1136 set thread context of 1848 1136 spoolsv.exe spoolsv.exe PID 912 set thread context of 1724 912 spoolsv.exe spoolsv.exe PID 1248 set thread context of 3000 1248 spoolsv.exe spoolsv.exe PID 2820 set thread context of 2528 2820 spoolsv.exe spoolsv.exe PID 2556 set thread context of 2288 2556 spoolsv.exe spoolsv.exe PID 1708 set thread context of 1764 1708 spoolsv.exe spoolsv.exe PID 2796 set thread context of 980 2796 spoolsv.exe spoolsv.exe PID 1332 set thread context of 1796 1332 spoolsv.exe spoolsv.exe PID 2928 set thread context of 2220 2928 spoolsv.exe spoolsv.exe PID 2596 set thread context of 1928 2596 spoolsv.exe spoolsv.exe PID 2628 set thread context of 2872 2628 spoolsv.exe spoolsv.exe PID 1868 set thread context of 2848 1868 spoolsv.exe spoolsv.exe PID 1620 set thread context of 764 1620 spoolsv.exe spoolsv.exe PID 1096 set thread context of 2104 1096 spoolsv.exe spoolsv.exe PID 1748 set thread context of 2024 1748 spoolsv.exe spoolsv.exe PID 2408 set thread context of 1576 2408 spoolsv.exe spoolsv.exe PID 2676 set thread context of 2020 2676 spoolsv.exe spoolsv.exe PID 2988 set thread context of 1400 2988 spoolsv.exe spoolsv.exe PID 2120 set thread context of 2072 2120 spoolsv.exe spoolsv.exe PID 404 set thread context of 2352 404 spoolsv.exe spoolsv.exe PID 2496 set thread context of 1452 2496 spoolsv.exe spoolsv.exe PID 2788 set thread context of 2816 2788 spoolsv.exe spoolsv.exe PID 3044 set thread context of 2988 3044 spoolsv.exe spoolsv.exe PID 264 set thread context of 628 264 spoolsv.exe spoolsv.exe PID 1504 set thread context of 2396 1504 spoolsv.exe spoolsv.exe PID 1716 set thread context of 832 1716 spoolsv.exe spoolsv.exe PID 1048 set thread context of 2388 1048 spoolsv.exe spoolsv.exe PID 1868 set thread context of 2096 1868 spoolsv.exe spoolsv.exe PID 2144 set thread context of 1680 2144 spoolsv.exe spoolsv.exe PID 1000 set thread context of 2856 1000 spoolsv.exe spoolsv.exe PID 264 set thread context of 2304 264 spoolsv.exe spoolsv.exe PID 2144 set thread context of 2688 2144 spoolsv.exe spoolsv.exe PID 2904 set thread context of 2944 2904 spoolsv.exe spoolsv.exe PID 2796 set thread context of 1728 2796 spoolsv.exe spoolsv.exe PID 2600 set thread context of 2644 2600 spoolsv.exe spoolsv.exe PID 3056 set thread context of 1708 3056 spoolsv.exe spoolsv.exe PID 1284 set thread context of 912 1284 spoolsv.exe spoolsv.exe PID 2152 set thread context of 2624 2152 spoolsv.exe spoolsv.exe PID 2740 set thread context of 1096 2740 spoolsv.exe spoolsv.exe PID 1804 set thread context of 2208 1804 spoolsv.exe spoolsv.exe PID 2724 set thread context of 3056 2724 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exeexplorer.exepid process 2060 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe 328 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 328 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1936 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 2060 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 2060 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 2592 explorer.exe 328 explorer.exe 328 explorer.exe 1644 spoolsv.exe 328 explorer.exe 328 explorer.exe 2120 spoolsv.exe 696 spoolsv.exe 1780 spoolsv.exe 2312 spoolsv.exe 2424 spoolsv.exe 2664 spoolsv.exe 2636 spoolsv.exe 3048 spoolsv.exe 1808 spoolsv.exe 2108 spoolsv.exe 2396 spoolsv.exe 1864 spoolsv.exe 832 spoolsv.exe 2816 spoolsv.exe 2680 spoolsv.exe 2636 spoolsv.exe 2732 spoolsv.exe 2960 spoolsv.exe 1136 spoolsv.exe 912 spoolsv.exe 1248 spoolsv.exe 2820 spoolsv.exe 2556 spoolsv.exe 1708 spoolsv.exe 2796 spoolsv.exe 1332 spoolsv.exe 2928 spoolsv.exe 2596 spoolsv.exe 2628 spoolsv.exe 1868 spoolsv.exe 1620 spoolsv.exe 1096 spoolsv.exe 1748 spoolsv.exe 2408 spoolsv.exe 2676 spoolsv.exe 2988 spoolsv.exe 2120 spoolsv.exe 404 spoolsv.exe 2496 spoolsv.exe 2788 spoolsv.exe 3044 spoolsv.exe 264 spoolsv.exe 1504 spoolsv.exe 1716 spoolsv.exe 1048 spoolsv.exe 1868 spoolsv.exe 2144 spoolsv.exe 1000 spoolsv.exe 264 spoolsv.exe 2144 spoolsv.exe 2904 spoolsv.exe 2796 spoolsv.exe 2600 spoolsv.exe 3056 spoolsv.exe 1284 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exedescription pid process target process PID 1936 wrote to memory of 1228 1936 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 1936 wrote to memory of 1228 1936 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 1936 wrote to memory of 1228 1936 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 1936 wrote to memory of 1228 1936 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 1936 wrote to memory of 1228 1936 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 1936 wrote to memory of 1228 1936 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 1936 wrote to memory of 1228 1936 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 1936 wrote to memory of 1228 1936 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 1936 wrote to memory of 1228 1936 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 1936 wrote to memory of 1228 1936 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 1936 wrote to memory of 1228 1936 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 1936 wrote to memory of 1228 1936 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 1936 wrote to memory of 1228 1936 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 1936 wrote to memory of 1228 1936 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 1228 wrote to memory of 804 1228 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe splwow64.exe PID 1228 wrote to memory of 804 1228 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe splwow64.exe PID 1228 wrote to memory of 804 1228 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe splwow64.exe PID 1228 wrote to memory of 804 1228 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe splwow64.exe PID 1228 wrote to memory of 2060 1228 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 1228 wrote to memory of 2060 1228 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 1228 wrote to memory of 2060 1228 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 1228 wrote to memory of 2060 1228 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 1228 wrote to memory of 2060 1228 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 1228 wrote to memory of 2060 1228 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe PID 2060 wrote to memory of 2592 2060 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe explorer.exe PID 2060 wrote to memory of 2592 2060 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe explorer.exe PID 2060 wrote to memory of 2592 2060 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe explorer.exe PID 2060 wrote to memory of 2592 2060 65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe explorer.exe PID 2592 wrote to memory of 3064 2592 explorer.exe explorer.exe PID 2592 wrote to memory of 3064 2592 explorer.exe explorer.exe PID 2592 wrote to memory of 3064 2592 explorer.exe explorer.exe PID 2592 wrote to memory of 3064 2592 explorer.exe explorer.exe PID 2592 wrote to memory of 3064 2592 explorer.exe explorer.exe PID 2592 wrote to memory of 3064 2592 explorer.exe explorer.exe PID 2592 wrote to memory of 3064 2592 explorer.exe explorer.exe PID 2592 wrote to memory of 3064 2592 explorer.exe explorer.exe PID 2592 wrote to memory of 3064 2592 explorer.exe explorer.exe PID 2592 wrote to memory of 3064 2592 explorer.exe explorer.exe PID 2592 wrote to memory of 3064 2592 explorer.exe explorer.exe PID 2592 wrote to memory of 3064 2592 explorer.exe explorer.exe PID 2592 wrote to memory of 3064 2592 explorer.exe explorer.exe PID 2592 wrote to memory of 3064 2592 explorer.exe explorer.exe PID 3064 wrote to memory of 328 3064 explorer.exe explorer.exe PID 3064 wrote to memory of 328 3064 explorer.exe explorer.exe PID 3064 wrote to memory of 328 3064 explorer.exe explorer.exe PID 3064 wrote to memory of 328 3064 explorer.exe explorer.exe PID 3064 wrote to memory of 328 3064 explorer.exe explorer.exe PID 3064 wrote to memory of 328 3064 explorer.exe explorer.exe PID 328 wrote to memory of 1644 328 explorer.exe spoolsv.exe PID 328 wrote to memory of 1644 328 explorer.exe spoolsv.exe PID 328 wrote to memory of 1644 328 explorer.exe spoolsv.exe PID 328 wrote to memory of 1644 328 explorer.exe spoolsv.exe PID 1644 wrote to memory of 2084 1644 spoolsv.exe spoolsv.exe PID 1644 wrote to memory of 2084 1644 spoolsv.exe spoolsv.exe PID 1644 wrote to memory of 2084 1644 spoolsv.exe spoolsv.exe PID 1644 wrote to memory of 2084 1644 spoolsv.exe spoolsv.exe PID 1644 wrote to memory of 2084 1644 spoolsv.exe spoolsv.exe PID 1644 wrote to memory of 2084 1644 spoolsv.exe spoolsv.exe PID 1644 wrote to memory of 2084 1644 spoolsv.exe spoolsv.exe PID 1644 wrote to memory of 2084 1644 spoolsv.exe spoolsv.exe PID 1644 wrote to memory of 2084 1644 spoolsv.exe spoolsv.exe PID 1644 wrote to memory of 2084 1644 spoolsv.exe spoolsv.exe PID 1644 wrote to memory of 2084 1644 spoolsv.exe spoolsv.exe PID 1644 wrote to memory of 2084 1644 spoolsv.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe"2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65ef0c33a4ac9ffb39032f1383d726eb_JaffaCakes118.exe"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:328 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:2084 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:4264
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2120 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:1280 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:2112
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:696 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:1988 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:5824
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1780 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:1660 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:5100
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2312 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:1056 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:4920
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵PID:5044
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:5456
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2424 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:2068 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:4420
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2664 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:3020 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2636 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:3028 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:4456
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3048 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:608 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:4688
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1808 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1132 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:3212
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2108 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:1652 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2396 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:1924 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1864 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2868 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:832 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:2064 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:5388
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2816 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:2808 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2680 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:1684 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:4260
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2636 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2200 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:7060
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2732 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:2864 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2960 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:1008 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1136 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:1848 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:4252
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:912 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:1724 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1248 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:3000 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:5908
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2820 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:2528 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2556 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:2288 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:6792
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1708 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:1764 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:5808
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2796 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:980 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1332 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:1796 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2928 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:2220 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2596 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1928 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2628 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
PID:2872 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:6904
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1868 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2848
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1620 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:764
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:6848
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1096 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2104
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1748 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2024
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2408 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:1576
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:6716
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2676 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2020
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:1940
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2988 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:1400
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2120 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2072
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:404 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:2352 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2496 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:1452
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:5828
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2788 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2816
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:4024
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3044 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2988
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:6316
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:264 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:628 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:5032
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1504 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2396
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1716 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:832
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1048 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2388
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1868 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2096
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2144 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:1680
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:1720
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2692
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:2960
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1000 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2856
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:2344
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:264 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:2304 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:6108
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2144 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:2688 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:5576
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵PID:5736
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵PID:5956
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2904 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2944
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2796 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:1728 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2600 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2644
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3056 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:1708
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1284 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:912
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:5284
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
PID:2152 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2624
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:5704
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
PID:2740 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:1096
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1804 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2208
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:1316
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2724 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:3056 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2476
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2776
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2244
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:1808
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:5200
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:2936 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2620
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:1240
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:1360
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:1248
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:1820
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:840
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:2192
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2228
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:352
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:2116
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:848
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:2508 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:1000
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:2000 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:112 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:556
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:1500
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2176
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:1148
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2480
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:1360 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:6220
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:1332
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2276
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2228
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2496
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:1600
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:1664 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2212
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2216
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:6920
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3088
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3184
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:3252 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3348
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:4496
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3416
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3512
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3580
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3676
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3784
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:3808 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3912
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4016
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:5196
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2360
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3156
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:5208
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3240
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3344
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:888
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3488
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3532
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3608
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3708
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3824
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3900
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:5932
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3984
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:4088 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:2724
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3264
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3388
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:3464 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:3604 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3668
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:5152
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:3748 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3864
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3976
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:1332 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:4640
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:3136 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:2724
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:3380 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:3392 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:5124
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3544
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:3628 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3848
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4040
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3120
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3260
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3396
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3432
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:2080
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3624
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:3816 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3788
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3964
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3164
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3300
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3484
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3644
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3832
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:3824 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:4580
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3784
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3092
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3328
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3400
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:928
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:3612 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:3248 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:2332
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4024
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3220
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:5968
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:3440 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3584
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3828
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3980
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3196
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3460
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3656
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3836
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3852
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3324
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:5972
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3332
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:3748 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3276
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:3848 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:5588
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3768
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:3600 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3336
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3384
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:4080 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3124
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:6148
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3336
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3108
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3196
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3756
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:3784 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3876
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3560
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:3896 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3844
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3968
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3624
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3276
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3448
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:3232 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:3772
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:3412 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:6076
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:3764 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:4148 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:4236 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4308
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4356
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4432
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:6976
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:4540 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:4620 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:620
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4708
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4788
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:6432
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4852
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4948
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:4960
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:5036
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:5112
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:4140 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:4232 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4364
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4388
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4516
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
PID:4604 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4704
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4800
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4868
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4856
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:5084
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4108
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:4224 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4328
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4364
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4536
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4612
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4740
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4904
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4988
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:5040 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4160
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:5756
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4228
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4368
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4456
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4544
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:4724 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4872
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:6664
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4868
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:5108
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:5088 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4288
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:4492 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4592
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4824
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4732
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:5028
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:3316
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4316
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4416
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵PID:7008
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4456
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4700
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4884
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4940
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
PID:4588 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:5056
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:5080
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:5104
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4100
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4136
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4208
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4168
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4400
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4652
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4980
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:5052
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4460
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:4600
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:4900
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:1908
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:6760
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:6364
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵PID:6588
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵PID:1320
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\System32\spool\drivers\x64\3\mxdwdui.BUDFilesize
56KB
MD5bd72dcf1083b6e22ccbfa0e8e27fb1e0
SHA13fd23d4f14da768da7b8364d74c54932d704e74e
SHA25690f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1
SHA51272360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562
-
\Windows\system\explorer.exeFilesize
2.6MB
MD5eccf01a736cb1f0cba73216a0806d14b
SHA11bd0ddc93a877cfc296d334b0126dbdb6da7e358
SHA25610db7550bb7ef352aaccdce21a0ef1217c5e3f3f982bdb7ce1555985b49ffba6
SHA5123f85c0e40132dead09ebc595b68bae824fab7d9e5bd46cbf0452c297b0eee1ed4a05d9b256a8884dace347cca0b6d56d6f79841866578cbdcad5c94b61a2ade3
-
\Windows\system\spoolsv.exeFilesize
2.6MB
MD5930631e65f168c75d41a56fae7c4c1e7
SHA1542e361615dabbafe6f8a1198e9f9ff24890b5d4
SHA2568169aee0a86cebcc59cb05d739c04e672b705ca6ec220c415a560f2629c48ed2
SHA5122b3d367e0af4681d2ca1a683a70f33e7bfbb6ac734c887e6d1f5a28260c1ba6ccfc85c4561555680cfef87544e54f85a7ae72778ed4a4d2c2951b3d8dd325fa7
-
memory/888-6365-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1228-5-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1228-24-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1228-6-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1228-38-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1228-7-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1228-3-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1228-4-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1240-6130-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1500-6392-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1936-2-0x0000000000407000-0x0000000000408000-memory.dmpFilesize
4KB
-
memory/1940-6201-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1940-6182-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2060-61-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2060-32-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2060-39-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2060-30-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2060-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2060-26-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2084-108-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2112-5425-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2116-5584-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2332-6418-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2344-5568-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2592-53-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2592-57-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2960-6284-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3064-58-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3064-79-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3064-62-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3064-89-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3212-6011-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4024-5493-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4252-5531-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4260-6148-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4264-5331-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4420-5466-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4420-5444-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4456-5542-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4580-5780-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4640-6382-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4688-5460-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4920-5589-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4920-5477-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5100-5412-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5152-5734-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5196-5800-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5284-5614-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5388-5628-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5576-5676-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5704-5600-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5808-5689-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5824-5705-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5968-6354-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5972-6226-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6316-5756-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6432-5865-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6716-6340-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB