Analysis
-
max time kernel
148s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 16:14
Behavioral task
behavioral1
Sample
6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe
-
Size
2.6MB
-
MD5
6f17faea8edc0117fef93ed766ac96bc
-
SHA1
5f006b93bb8af78dc7b57312f384f099f2969d10
-
SHA256
5966bc3d1d118cc440662fffdac4228566be1e346dc286fc9ea2b7f535937133
-
SHA512
54114749b68fa8ecafe77bf29babea93574f70de21ae455cdefd20f64187fdb2e1f12083515983ba25925ede483c6dce8ebe0c1127dcb744478f88b075a3466d
-
SSDEEP
49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlL:86SIROiFJiwp0xlrlL
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2812 explorer.exe 2336 explorer.exe 1660 explorer.exe 1464 spoolsv.exe 1720 spoolsv.exe 1956 spoolsv.exe 1088 spoolsv.exe 336 spoolsv.exe 840 spoolsv.exe 700 spoolsv.exe 1752 spoolsv.exe 2992 spoolsv.exe 1776 spoolsv.exe 1640 spoolsv.exe 2616 spoolsv.exe 1352 spoolsv.exe 2664 spoolsv.exe 2812 spoolsv.exe 2356 spoolsv.exe 1576 spoolsv.exe 2312 spoolsv.exe 2196 spoolsv.exe 2204 spoolsv.exe 576 spoolsv.exe 536 spoolsv.exe 2960 spoolsv.exe 1884 spoolsv.exe 2340 spoolsv.exe 2948 spoolsv.exe 456 spoolsv.exe 2468 spoolsv.exe 2088 spoolsv.exe 1496 spoolsv.exe 2808 spoolsv.exe 1976 spoolsv.exe 2980 spoolsv.exe 2484 spoolsv.exe 1544 spoolsv.exe 2196 spoolsv.exe 868 spoolsv.exe 3036 spoolsv.exe 2248 spoolsv.exe 2360 spoolsv.exe 1824 spoolsv.exe 1532 spoolsv.exe 2608 spoolsv.exe 1000 spoolsv.exe 2036 spoolsv.exe 1740 spoolsv.exe 2796 spoolsv.exe 992 spoolsv.exe 1888 spoolsv.exe 2328 spoolsv.exe 1484 spoolsv.exe 2828 spoolsv.exe 1988 spoolsv.exe 1476 spoolsv.exe 2056 spoolsv.exe 2576 spoolsv.exe 1156 spoolsv.exe 2684 spoolsv.exe 2784 spoolsv.exe 852 spoolsv.exe 2184 spoolsv.exe -
Loads dropped DLL 64 IoCs
Processes:
6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2548 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 2548 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 1660 explorer.exe 1660 explorer.exe 1464 spoolsv.exe 1660 explorer.exe 1660 explorer.exe 1956 spoolsv.exe 1660 explorer.exe 1660 explorer.exe 336 spoolsv.exe 1660 explorer.exe 1660 explorer.exe 700 spoolsv.exe 1660 explorer.exe 1660 explorer.exe 2992 spoolsv.exe 1660 explorer.exe 1660 explorer.exe 1640 spoolsv.exe 1660 explorer.exe 1660 explorer.exe 1352 spoolsv.exe 1660 explorer.exe 1660 explorer.exe 2812 spoolsv.exe 1660 explorer.exe 1660 explorer.exe 1576 spoolsv.exe 1660 explorer.exe 1660 explorer.exe 2196 spoolsv.exe 1660 explorer.exe 1660 explorer.exe 576 spoolsv.exe 1660 explorer.exe 1660 explorer.exe 2960 spoolsv.exe 1660 explorer.exe 1660 explorer.exe 2340 spoolsv.exe 1660 explorer.exe 1660 explorer.exe 456 spoolsv.exe 1660 explorer.exe 1660 explorer.exe 2088 spoolsv.exe 1660 explorer.exe 1660 explorer.exe 2808 spoolsv.exe 1660 explorer.exe 1660 explorer.exe 2980 spoolsv.exe 1660 explorer.exe 1660 explorer.exe 1544 spoolsv.exe 1660 explorer.exe 1660 explorer.exe 868 spoolsv.exe 1660 explorer.exe 1660 explorer.exe 2248 spoolsv.exe 1660 explorer.exe 1660 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 2036 set thread context of 2868 2036 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2868 set thread context of 2548 2868 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2812 set thread context of 2336 2812 explorer.exe explorer.exe PID 2336 set thread context of 1660 2336 explorer.exe explorer.exe PID 1464 set thread context of 1720 1464 spoolsv.exe spoolsv.exe PID 1956 set thread context of 1088 1956 spoolsv.exe spoolsv.exe PID 336 set thread context of 840 336 spoolsv.exe spoolsv.exe PID 700 set thread context of 1752 700 spoolsv.exe spoolsv.exe PID 2992 set thread context of 1776 2992 spoolsv.exe spoolsv.exe PID 1640 set thread context of 2616 1640 spoolsv.exe spoolsv.exe PID 1352 set thread context of 2664 1352 spoolsv.exe spoolsv.exe PID 2812 set thread context of 2356 2812 spoolsv.exe spoolsv.exe PID 1576 set thread context of 2312 1576 spoolsv.exe spoolsv.exe PID 2196 set thread context of 2204 2196 spoolsv.exe spoolsv.exe PID 576 set thread context of 536 576 spoolsv.exe spoolsv.exe PID 2960 set thread context of 1884 2960 spoolsv.exe spoolsv.exe PID 2340 set thread context of 2948 2340 spoolsv.exe spoolsv.exe PID 456 set thread context of 2468 456 spoolsv.exe spoolsv.exe PID 2088 set thread context of 1496 2088 spoolsv.exe spoolsv.exe PID 2808 set thread context of 1976 2808 spoolsv.exe spoolsv.exe PID 2980 set thread context of 2484 2980 spoolsv.exe spoolsv.exe PID 1544 set thread context of 2196 1544 spoolsv.exe spoolsv.exe PID 868 set thread context of 3036 868 spoolsv.exe spoolsv.exe PID 2248 set thread context of 2360 2248 spoolsv.exe spoolsv.exe PID 1824 set thread context of 1532 1824 spoolsv.exe spoolsv.exe PID 2608 set thread context of 1000 2608 spoolsv.exe spoolsv.exe PID 2036 set thread context of 1740 2036 spoolsv.exe spoolsv.exe PID 2796 set thread context of 992 2796 spoolsv.exe spoolsv.exe PID 1888 set thread context of 2328 1888 spoolsv.exe spoolsv.exe PID 1484 set thread context of 2828 1484 spoolsv.exe spoolsv.exe PID 1988 set thread context of 1476 1988 spoolsv.exe spoolsv.exe PID 2056 set thread context of 2576 2056 spoolsv.exe spoolsv.exe PID 1156 set thread context of 2684 1156 spoolsv.exe spoolsv.exe PID 2784 set thread context of 852 2784 spoolsv.exe spoolsv.exe PID 2184 set thread context of 1844 2184 spoolsv.exe spoolsv.exe PID 1544 set thread context of 1276 1544 spoolsv.exe spoolsv.exe PID 1288 set thread context of 2084 1288 spoolsv.exe spoolsv.exe PID 1116 set thread context of 1528 1116 spoolsv.exe spoolsv.exe PID 2008 set thread context of 1368 2008 spoolsv.exe spoolsv.exe PID 2784 set thread context of 2632 2784 spoolsv.exe spoolsv.exe PID 1968 set thread context of 2676 1968 spoolsv.exe spoolsv.exe PID 2144 set thread context of 2852 2144 spoolsv.exe spoolsv.exe PID 784 set thread context of 676 784 spoolsv.exe spoolsv.exe PID 2860 set thread context of 2132 2860 spoolsv.exe spoolsv.exe PID 2624 set thread context of 2980 2624 spoolsv.exe spoolsv.exe PID 2120 set thread context of 628 2120 spoolsv.exe spoolsv.exe PID 904 set thread context of 988 904 spoolsv.exe spoolsv.exe PID 2248 set thread context of 784 2248 spoolsv.exe spoolsv.exe PID 2940 set thread context of 2972 2940 spoolsv.exe spoolsv.exe PID 1656 set thread context of 1444 1656 spoolsv.exe spoolsv.exe PID 1516 set thread context of 1408 1516 spoolsv.exe spoolsv.exe PID 3000 set thread context of 3044 3000 spoolsv.exe spoolsv.exe PID 2536 set thread context of 2388 2536 spoolsv.exe spoolsv.exe PID 2624 set thread context of 2424 2624 spoolsv.exe spoolsv.exe PID 1804 set thread context of 780 1804 spoolsv.exe spoolsv.exe PID 1208 set thread context of 2924 1208 spoolsv.exe spoolsv.exe PID 2436 set thread context of 240 2436 spoolsv.exe spoolsv.exe PID 1552 set thread context of 1416 1552 spoolsv.exe spoolsv.exe PID 700 set thread context of 2220 700 spoolsv.exe spoolsv.exe PID 360 set thread context of 1504 360 spoolsv.exe spoolsv.exe PID 352 set thread context of 2144 352 spoolsv.exe spoolsv.exe PID 1256 set thread context of 2516 1256 spoolsv.exe spoolsv.exe PID 2332 set thread context of 2176 2332 spoolsv.exe spoolsv.exe PID 1672 set thread context of 1428 1672 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exe6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exeexplorer.exepid process 2548 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe 1660 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1660 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2036 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 2548 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 2548 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 2812 explorer.exe 1660 explorer.exe 1660 explorer.exe 1464 spoolsv.exe 1660 explorer.exe 1660 explorer.exe 1956 spoolsv.exe 336 spoolsv.exe 700 spoolsv.exe 2992 spoolsv.exe 1640 spoolsv.exe 1352 spoolsv.exe 2812 spoolsv.exe 1576 spoolsv.exe 2196 spoolsv.exe 576 spoolsv.exe 2960 spoolsv.exe 2340 spoolsv.exe 456 spoolsv.exe 2088 spoolsv.exe 2808 spoolsv.exe 2980 spoolsv.exe 1544 spoolsv.exe 868 spoolsv.exe 2248 spoolsv.exe 1824 spoolsv.exe 2608 spoolsv.exe 2036 spoolsv.exe 2796 spoolsv.exe 1888 spoolsv.exe 1484 spoolsv.exe 1988 spoolsv.exe 2056 spoolsv.exe 1156 spoolsv.exe 2784 spoolsv.exe 2184 spoolsv.exe 1544 spoolsv.exe 1288 spoolsv.exe 1116 spoolsv.exe 2008 spoolsv.exe 2784 spoolsv.exe 1968 spoolsv.exe 2144 spoolsv.exe 784 spoolsv.exe 2860 spoolsv.exe 2624 spoolsv.exe 2120 spoolsv.exe 904 spoolsv.exe 2248 spoolsv.exe 2940 spoolsv.exe 1656 spoolsv.exe 1516 spoolsv.exe 3000 spoolsv.exe 2536 spoolsv.exe 2624 spoolsv.exe 1804 spoolsv.exe 1208 spoolsv.exe 2436 spoolsv.exe 1552 spoolsv.exe 700 spoolsv.exe 360 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exedescription pid process target process PID 2036 wrote to memory of 2868 2036 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2036 wrote to memory of 2868 2036 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2036 wrote to memory of 2868 2036 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2036 wrote to memory of 2868 2036 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2036 wrote to memory of 2868 2036 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2036 wrote to memory of 2868 2036 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2036 wrote to memory of 2868 2036 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2036 wrote to memory of 2868 2036 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2036 wrote to memory of 2868 2036 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2036 wrote to memory of 2868 2036 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2036 wrote to memory of 2868 2036 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2036 wrote to memory of 2868 2036 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2036 wrote to memory of 2868 2036 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2036 wrote to memory of 2868 2036 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2868 wrote to memory of 3020 2868 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe splwow64.exe PID 2868 wrote to memory of 3020 2868 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe splwow64.exe PID 2868 wrote to memory of 3020 2868 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe splwow64.exe PID 2868 wrote to memory of 3020 2868 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe splwow64.exe PID 2868 wrote to memory of 2548 2868 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2868 wrote to memory of 2548 2868 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2868 wrote to memory of 2548 2868 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2868 wrote to memory of 2548 2868 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2868 wrote to memory of 2548 2868 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2868 wrote to memory of 2548 2868 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe PID 2548 wrote to memory of 2812 2548 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe explorer.exe PID 2548 wrote to memory of 2812 2548 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe explorer.exe PID 2548 wrote to memory of 2812 2548 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe explorer.exe PID 2548 wrote to memory of 2812 2548 6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe explorer.exe PID 2812 wrote to memory of 2336 2812 explorer.exe explorer.exe PID 2812 wrote to memory of 2336 2812 explorer.exe explorer.exe PID 2812 wrote to memory of 2336 2812 explorer.exe explorer.exe PID 2812 wrote to memory of 2336 2812 explorer.exe explorer.exe PID 2812 wrote to memory of 2336 2812 explorer.exe explorer.exe PID 2812 wrote to memory of 2336 2812 explorer.exe explorer.exe PID 2812 wrote to memory of 2336 2812 explorer.exe explorer.exe PID 2812 wrote to memory of 2336 2812 explorer.exe explorer.exe PID 2812 wrote to memory of 2336 2812 explorer.exe explorer.exe PID 2812 wrote to memory of 2336 2812 explorer.exe explorer.exe PID 2812 wrote to memory of 2336 2812 explorer.exe explorer.exe PID 2812 wrote to memory of 2336 2812 explorer.exe explorer.exe PID 2812 wrote to memory of 2336 2812 explorer.exe explorer.exe PID 2812 wrote to memory of 2336 2812 explorer.exe explorer.exe PID 2336 wrote to memory of 1660 2336 explorer.exe explorer.exe PID 2336 wrote to memory of 1660 2336 explorer.exe explorer.exe PID 2336 wrote to memory of 1660 2336 explorer.exe explorer.exe PID 2336 wrote to memory of 1660 2336 explorer.exe explorer.exe PID 2336 wrote to memory of 1660 2336 explorer.exe explorer.exe PID 2336 wrote to memory of 1660 2336 explorer.exe explorer.exe PID 1660 wrote to memory of 1464 1660 explorer.exe spoolsv.exe PID 1660 wrote to memory of 1464 1660 explorer.exe spoolsv.exe PID 1660 wrote to memory of 1464 1660 explorer.exe spoolsv.exe PID 1660 wrote to memory of 1464 1660 explorer.exe spoolsv.exe PID 1464 wrote to memory of 1720 1464 spoolsv.exe spoolsv.exe PID 1464 wrote to memory of 1720 1464 spoolsv.exe spoolsv.exe PID 1464 wrote to memory of 1720 1464 spoolsv.exe spoolsv.exe PID 1464 wrote to memory of 1720 1464 spoolsv.exe spoolsv.exe PID 1464 wrote to memory of 1720 1464 spoolsv.exe spoolsv.exe PID 1464 wrote to memory of 1720 1464 spoolsv.exe spoolsv.exe PID 1464 wrote to memory of 1720 1464 spoolsv.exe spoolsv.exe PID 1464 wrote to memory of 1720 1464 spoolsv.exe spoolsv.exe PID 1464 wrote to memory of 1720 1464 spoolsv.exe spoolsv.exe PID 1464 wrote to memory of 1720 1464 spoolsv.exe spoolsv.exe PID 1464 wrote to memory of 1720 1464 spoolsv.exe spoolsv.exe PID 1464 wrote to memory of 1720 1464 spoolsv.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe"2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
C:\Users\Admin\AppData\Local\Temp\6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6f17faea8edc0117fef93ed766ac96bc_JaffaCakes118.exe"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE8⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System32\spool\drivers\x64\3\mxdwdui.BUDFilesize
56KB
MD5bd72dcf1083b6e22ccbfa0e8e27fb1e0
SHA13fd23d4f14da768da7b8364d74c54932d704e74e
SHA25690f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1
SHA51272360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562
-
\Windows\system\explorer.exeFilesize
2.6MB
MD5c902ecf27dca896ecf3b9d776fdd0024
SHA105753dd75f022f4a47a5fdb9925af900c9fc4c44
SHA256e1d17c5731c0ae00aa1af48135f30b3f2489c56b32a8e635921974654bbe9750
SHA512d1f79b49cf550d1caf2fed620e7fbffe6e3c734d991f4e7f4ee01371a9b32bf41bc46eea45234919416e69a63a16020a6c0fe57c70b0dfda842854425f711ea3
-
\Windows\system\spoolsv.exeFilesize
2.6MB
MD5b9c3263d7b1a5d1259c121bc2768f59b
SHA1849b73c0e4d79d044fa7bc67e86f3c8df9124d6f
SHA256081950f433cd45b5fee346977528de0afad4234d01b2c69e67f3263635699879
SHA512a2816f077e33d2f78f370cdd9cea2c566160773f305d7ebbd369e5e0281e6a9e40a4950910068f52cbd689fd865a747bbb3f4c528cec2730f87a966f1a585b5e
-
memory/1720-107-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2036-2-0x0000000000407000-0x0000000000408000-memory.dmpFilesize
4KB
-
memory/2112-6635-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2112-6640-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2336-57-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2336-87-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2336-79-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2336-62-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2548-30-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2548-40-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2548-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2548-26-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2548-33-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2548-61-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2812-53-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2812-58-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2868-24-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2868-38-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2868-6-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2868-4-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2868-5-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2868-3-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2868-7-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5152-6515-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5268-6531-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5384-6565-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5432-6548-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5532-6584-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5816-6620-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5904-6492-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5960-6709-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6440-6706-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6452-6681-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/7056-6854-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/7064-6821-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/7092-6757-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/7404-6860-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/7552-6767-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/7780-6840-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/8032-6864-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/8060-6764-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/8080-6778-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/8092-6792-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB