Analysis
-
max time kernel
134s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 16:24
Behavioral task
behavioral1
Sample
728eac999a91b0617231b002fa305343_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
728eac999a91b0617231b002fa305343_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
728eac999a91b0617231b002fa305343
-
SHA1
87e2f671d62c038ca9f69ae77bb71c7b20f0a055
-
SHA256
b3fddc600956aa70c37e7378be09532f804ed92ed282c84cd39f641ae60ee59b
-
SHA512
d190a037844aafded9899058e99b2b06fea5b85a0cee19d71da995a4d4a3cd609cc2d4fcedc4dc7f0d3bf16c10d3f03b8109ac9c16016c8c0060ae69c36596bd
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZu:0UzeyQMS4DqodCnoe+iitjWww6
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
728eac999a91b0617231b002fa305343_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\728eac999a91b0617231b002fa305343_JaffaCakes118.exe 728eac999a91b0617231b002fa305343_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\728eac999a91b0617231b002fa305343_JaffaCakes118.exe 728eac999a91b0617231b002fa305343_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exepid process 2968 explorer.exe 4940 explorer.exe 1192 spoolsv.exe 224 spoolsv.exe 456 spoolsv.exe 2240 spoolsv.exe 4256 spoolsv.exe 116 spoolsv.exe 3888 spoolsv.exe 880 spoolsv.exe 2372 spoolsv.exe 4916 spoolsv.exe 1968 spoolsv.exe 384 spoolsv.exe 1752 spoolsv.exe 5112 spoolsv.exe 1936 spoolsv.exe 5000 spoolsv.exe 3416 spoolsv.exe 3412 spoolsv.exe 4564 spoolsv.exe 4252 spoolsv.exe 1872 spoolsv.exe 3128 spoolsv.exe 4780 spoolsv.exe 1272 spoolsv.exe 2604 spoolsv.exe 4152 spoolsv.exe 3572 spoolsv.exe 2812 spoolsv.exe 4264 spoolsv.exe 4788 explorer.exe 1200 spoolsv.exe 3588 spoolsv.exe 3268 spoolsv.exe 4232 spoolsv.exe 3136 spoolsv.exe 1176 explorer.exe 408 spoolsv.exe 5024 spoolsv.exe 1660 spoolsv.exe 2980 spoolsv.exe 1760 spoolsv.exe 4484 spoolsv.exe 2080 spoolsv.exe 3820 explorer.exe 3356 spoolsv.exe 4208 spoolsv.exe 4248 spoolsv.exe 4760 spoolsv.exe 4140 spoolsv.exe 4472 explorer.exe 1100 spoolsv.exe 372 spoolsv.exe 1104 spoolsv.exe 1396 spoolsv.exe 4544 spoolsv.exe 552 explorer.exe 4644 spoolsv.exe 3848 spoolsv.exe 3588 spoolsv.exe 2232 spoolsv.exe 4772 explorer.exe 3204 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 41 IoCs
Processes:
728eac999a91b0617231b002fa305343_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exedescription pid process target process PID 1752 set thread context of 448 1752 728eac999a91b0617231b002fa305343_JaffaCakes118.exe 728eac999a91b0617231b002fa305343_JaffaCakes118.exe PID 2968 set thread context of 4940 2968 explorer.exe explorer.exe PID 1192 set thread context of 4264 1192 spoolsv.exe spoolsv.exe PID 224 set thread context of 3588 224 spoolsv.exe spoolsv.exe PID 456 set thread context of 3268 456 spoolsv.exe spoolsv.exe PID 2240 set thread context of 4232 2240 spoolsv.exe spoolsv.exe PID 4256 set thread context of 3136 4256 spoolsv.exe spoolsv.exe PID 116 set thread context of 5024 116 spoolsv.exe spoolsv.exe PID 3888 set thread context of 1660 3888 spoolsv.exe spoolsv.exe PID 880 set thread context of 2980 880 spoolsv.exe spoolsv.exe PID 2372 set thread context of 1760 2372 spoolsv.exe spoolsv.exe PID 4916 set thread context of 2080 4916 spoolsv.exe spoolsv.exe PID 1968 set thread context of 3356 1968 spoolsv.exe spoolsv.exe PID 384 set thread context of 4208 384 spoolsv.exe spoolsv.exe PID 1752 set thread context of 4248 1752 spoolsv.exe spoolsv.exe PID 5112 set thread context of 4140 5112 spoolsv.exe spoolsv.exe PID 1936 set thread context of 1100 1936 spoolsv.exe spoolsv.exe PID 5000 set thread context of 372 5000 spoolsv.exe spoolsv.exe PID 3416 set thread context of 1104 3416 spoolsv.exe spoolsv.exe PID 3412 set thread context of 4544 3412 spoolsv.exe spoolsv.exe PID 4564 set thread context of 4644 4564 spoolsv.exe spoolsv.exe PID 4252 set thread context of 3848 4252 spoolsv.exe spoolsv.exe PID 1872 set thread context of 2232 1872 spoolsv.exe spoolsv.exe PID 3128 set thread context of 3204 3128 spoolsv.exe spoolsv.exe PID 4780 set thread context of 4804 4780 spoolsv.exe spoolsv.exe PID 1272 set thread context of 4060 1272 spoolsv.exe spoolsv.exe PID 2604 set thread context of 3316 2604 spoolsv.exe spoolsv.exe PID 4152 set thread context of 4340 4152 spoolsv.exe spoolsv.exe PID 3572 set thread context of 2268 3572 spoolsv.exe spoolsv.exe PID 2812 set thread context of 4932 2812 spoolsv.exe spoolsv.exe PID 4788 set thread context of 4752 4788 explorer.exe explorer.exe PID 1200 set thread context of 4712 1200 spoolsv.exe spoolsv.exe PID 1176 set thread context of 2168 1176 explorer.exe explorer.exe PID 408 set thread context of 1456 408 spoolsv.exe spoolsv.exe PID 3820 set thread context of 1796 3820 explorer.exe explorer.exe PID 4484 set thread context of 1792 4484 spoolsv.exe spoolsv.exe PID 4760 set thread context of 2948 4760 spoolsv.exe spoolsv.exe PID 4472 set thread context of 4756 4472 explorer.exe explorer.exe PID 552 set thread context of 3184 552 explorer.exe explorer.exe PID 1396 set thread context of 3384 1396 spoolsv.exe spoolsv.exe PID 3588 set thread context of 3256 3588 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exe728eac999a91b0617231b002fa305343_JaffaCakes118.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exe728eac999a91b0617231b002fa305343_JaffaCakes118.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini 728eac999a91b0617231b002fa305343_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 728eac999a91b0617231b002fa305343_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
728eac999a91b0617231b002fa305343_JaffaCakes118.exeexplorer.exepid process 448 728eac999a91b0617231b002fa305343_JaffaCakes118.exe 448 728eac999a91b0617231b002fa305343_JaffaCakes118.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 4940 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
728eac999a91b0617231b002fa305343_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exepid process 448 728eac999a91b0617231b002fa305343_JaffaCakes118.exe 448 728eac999a91b0617231b002fa305343_JaffaCakes118.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4940 explorer.exe 4264 spoolsv.exe 4264 spoolsv.exe 3588 spoolsv.exe 3588 spoolsv.exe 3268 spoolsv.exe 3268 spoolsv.exe 4232 spoolsv.exe 4232 spoolsv.exe 3136 spoolsv.exe 3136 spoolsv.exe 5024 spoolsv.exe 5024 spoolsv.exe 1660 spoolsv.exe 1660 spoolsv.exe 2980 spoolsv.exe 2980 spoolsv.exe 1760 spoolsv.exe 1760 spoolsv.exe 2080 spoolsv.exe 2080 spoolsv.exe 3356 spoolsv.exe 3356 spoolsv.exe 4208 spoolsv.exe 4208 spoolsv.exe 4248 spoolsv.exe 4248 spoolsv.exe 4140 spoolsv.exe 4140 spoolsv.exe 1100 spoolsv.exe 1100 spoolsv.exe 372 spoolsv.exe 372 spoolsv.exe 1104 spoolsv.exe 1104 spoolsv.exe 4544 spoolsv.exe 4544 spoolsv.exe 4644 spoolsv.exe 4644 spoolsv.exe 3848 spoolsv.exe 3848 spoolsv.exe 2232 spoolsv.exe 2232 spoolsv.exe 3204 spoolsv.exe 3204 spoolsv.exe 4804 spoolsv.exe 4804 spoolsv.exe 4060 spoolsv.exe 4060 spoolsv.exe 3316 spoolsv.exe 3316 spoolsv.exe 4340 spoolsv.exe 4340 spoolsv.exe 2268 spoolsv.exe 2268 spoolsv.exe 4932 spoolsv.exe 4932 spoolsv.exe 4752 explorer.exe 4752 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
728eac999a91b0617231b002fa305343_JaffaCakes118.exe728eac999a91b0617231b002fa305343_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 1752 wrote to memory of 4688 1752 728eac999a91b0617231b002fa305343_JaffaCakes118.exe splwow64.exe PID 1752 wrote to memory of 4688 1752 728eac999a91b0617231b002fa305343_JaffaCakes118.exe splwow64.exe PID 1752 wrote to memory of 448 1752 728eac999a91b0617231b002fa305343_JaffaCakes118.exe 728eac999a91b0617231b002fa305343_JaffaCakes118.exe PID 1752 wrote to memory of 448 1752 728eac999a91b0617231b002fa305343_JaffaCakes118.exe 728eac999a91b0617231b002fa305343_JaffaCakes118.exe PID 1752 wrote to memory of 448 1752 728eac999a91b0617231b002fa305343_JaffaCakes118.exe 728eac999a91b0617231b002fa305343_JaffaCakes118.exe PID 1752 wrote to memory of 448 1752 728eac999a91b0617231b002fa305343_JaffaCakes118.exe 728eac999a91b0617231b002fa305343_JaffaCakes118.exe PID 1752 wrote to memory of 448 1752 728eac999a91b0617231b002fa305343_JaffaCakes118.exe 728eac999a91b0617231b002fa305343_JaffaCakes118.exe PID 448 wrote to memory of 2968 448 728eac999a91b0617231b002fa305343_JaffaCakes118.exe explorer.exe PID 448 wrote to memory of 2968 448 728eac999a91b0617231b002fa305343_JaffaCakes118.exe explorer.exe PID 448 wrote to memory of 2968 448 728eac999a91b0617231b002fa305343_JaffaCakes118.exe explorer.exe PID 2968 wrote to memory of 4940 2968 explorer.exe explorer.exe PID 2968 wrote to memory of 4940 2968 explorer.exe explorer.exe PID 2968 wrote to memory of 4940 2968 explorer.exe explorer.exe PID 2968 wrote to memory of 4940 2968 explorer.exe explorer.exe PID 2968 wrote to memory of 4940 2968 explorer.exe explorer.exe PID 4940 wrote to memory of 1192 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 1192 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 1192 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 224 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 224 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 224 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 456 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 456 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 456 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 2240 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 2240 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 2240 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 4256 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 4256 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 4256 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 116 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 116 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 116 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 3888 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 3888 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 3888 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 880 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 880 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 880 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 2372 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 2372 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 2372 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 4916 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 4916 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 4916 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 1968 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 1968 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 1968 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 384 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 384 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 384 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 1752 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 1752 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 1752 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 5112 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 5112 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 5112 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 1936 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 1936 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 1936 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 5000 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 5000 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 5000 4940 explorer.exe spoolsv.exe PID 4940 wrote to memory of 3416 4940 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\728eac999a91b0617231b002fa305343_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\728eac999a91b0617231b002fa305343_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\728eac999a91b0617231b002fa305343_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\728eac999a91b0617231b002fa305343_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD5e51a0807ada4c94ec81e63886fb96c36
SHA15b1ef9fd94e83565c7839f118a013ff1f5b69955
SHA256dfe98092d5038fcf0613d9db825824f296ad6728db74f736c58724b0821c077e
SHA5123ae7181b5b11763dd544c1e3c594f06bbdabc6324c0313349be9a3e6b74e62894ac37197299d492fc0b243557f17d3154228e04aac4d978acca9d0d54dc649b3
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD555c71ba88879fb880a762caf55c509dd
SHA18bf25f1ad4ab64ad3aee112390b6f272531544fe
SHA256396b4ab4ce9fca2feee5ceabe2f0559a1c55363e09d20869958dcfd503f1b492
SHA5122e2aba07bf1af87312441542ce3eb746ad6da833fda75fec88a1dc3f0b1f1e1c4102c7b7beeacf2d52f6e04f656aac226775f98c281c3f22ec96c12bbe5e97de
-
memory/116-1081-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/224-887-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/224-1867-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/372-2389-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/384-1394-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/448-64-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/448-62-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/448-36-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/448-34-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/456-888-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/456-1887-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/640-4762-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/880-1203-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1100-2375-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1104-2398-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1192-1775-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1192-786-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1456-3686-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1456-3824-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1660-2040-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1752-37-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1752-0-0x0000000002440000-0x0000000002441000-memory.dmpFilesize
4KB
-
memory/1752-1512-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1752-33-0x0000000002440000-0x0000000002441000-memory.dmpFilesize
4KB
-
memory/1752-31-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1760-2070-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1796-3920-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1872-1888-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1936-1707-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1968-1393-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2080-2290-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2080-2220-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2168-3679-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2200-5199-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2200-5115-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2232-2696-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2232-2853-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2240-1893-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2240-889-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2372-1204-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2624-4960-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2656-4520-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2656-4522-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2932-4972-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2948-4183-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2968-76-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2968-70-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2980-2050-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3136-2115-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3136-1951-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3184-4323-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3204-2703-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3256-4509-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3256-4640-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3260-4774-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3268-1886-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3316-2899-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3356-2230-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3412-1778-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3416-1714-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3588-1878-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3832-5136-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3848-2579-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3888-1202-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3956-4671-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3992-5127-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4080-5051-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4080-4950-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4140-2526-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4140-2368-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4208-2241-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4232-1898-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4248-2251-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4252-1877-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4256-1080-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4264-1780-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4264-1933-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4340-2909-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4544-2559-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4564-1779-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4632-4661-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4632-4835-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4644-2566-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4712-3515-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4712-3387-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4752-3309-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4756-4198-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4804-2713-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4916-1392-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4932-3094-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4932-3087-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4940-785-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4940-75-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5000-1708-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5024-2032-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5024-2029-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5112-1513-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB