pony | e87ee8fb500facf4af3aefb17ce4d46e94f0b2c99e5eac9a39587a04156cce85

General

Target

783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
Size

2.6MB
MD5

783dce01685a119f8d228a028034bd9e
SHA1

a03c6f94021917b3b85d763b435f26631db02a38
SHA256

e87ee8fb500facf4af3aefb17ce4d46e94f0b2c99e5eac9a39587a04156cce85
SHA512

cb8c1530f662464383de0e0826dfea022f377328f80f765767cb95903607acec011575284272d3be9288567886b3bb4efa10122d7c20f2140b448a0286fdec07
SSDEEP

49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrll:86SIROiFJiwp0xlrll

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

Processes:

783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe

Executes dropped EXE 52 IoCs

Processes:

explorer.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

pid	process
2444	explorer.exe
772	explorer.exe
2008	explorer.exe
2304	spoolsv.exe
916	spoolsv.exe
856	spoolsv.exe
1784	spoolsv.exe
2164	spoolsv.exe
2756	spoolsv.exe
2912	spoolsv.exe
1664	spoolsv.exe
1608	spoolsv.exe
2848	spoolsv.exe
2272	spoolsv.exe
2540	spoolsv.exe
1372	spoolsv.exe
2840	spoolsv.exe
276	spoolsv.exe
1816	spoolsv.exe
868	spoolsv.exe
2332	spoolsv.exe
748	spoolsv.exe
1772	spoolsv.exe
1468	spoolsv.exe
2912	spoolsv.exe
1956	spoolsv.exe
1508	spoolsv.exe
2216	spoolsv.exe
2616	spoolsv.exe
2520	spoolsv.exe
2412	spoolsv.exe
2408	spoolsv.exe
744	spoolsv.exe
324	spoolsv.exe
1652	spoolsv.exe
924	spoolsv.exe
2748	spoolsv.exe
684	spoolsv.exe
3032	spoolsv.exe
3008	spoolsv.exe
956	spoolsv.exe
2292	spoolsv.exe
2548	spoolsv.exe
2424	spoolsv.exe
476	spoolsv.exe
2344	spoolsv.exe
2144	spoolsv.exe
1044	spoolsv.exe
2176	spoolsv.exe
1968	spoolsv.exe
888	spoolsv.exe
1564	spoolsv.exe

Loads dropped DLL 64 IoCs

Processes:

783dce01685a119f8d228a028034bd9e_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

pid	process
2392	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
2392	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
2008	explorer.exe
2008	explorer.exe
2304	spoolsv.exe
2008	explorer.exe
2008	explorer.exe
856	spoolsv.exe
2008	explorer.exe
2008	explorer.exe
2164	spoolsv.exe
2008	explorer.exe
2008	explorer.exe
2912	spoolsv.exe
2008	explorer.exe
2008	explorer.exe
1608	spoolsv.exe
2008	explorer.exe
2008	explorer.exe
2272	spoolsv.exe
2008	explorer.exe
2008	explorer.exe
1372	spoolsv.exe
2008	explorer.exe
2008	explorer.exe
276	spoolsv.exe
2008	explorer.exe
2008	explorer.exe
868	spoolsv.exe
2008	explorer.exe
2008	explorer.exe
748	spoolsv.exe
2008	explorer.exe
2008	explorer.exe
1468	spoolsv.exe
2008	explorer.exe
2008	explorer.exe
1956	spoolsv.exe
2008	explorer.exe
2008	explorer.exe
2216	spoolsv.exe
2008	explorer.exe
2008	explorer.exe
2520	spoolsv.exe
2008	explorer.exe
2008	explorer.exe
2408	spoolsv.exe
2008	explorer.exe
2008	explorer.exe
324	spoolsv.exe
2008	explorer.exe
2008	explorer.exe
924	spoolsv.exe
2008	explorer.exe
2008	explorer.exe
684	spoolsv.exe
2008	explorer.exe
2008	explorer.exe
3008	spoolsv.exe
2008	explorer.exe
2008	explorer.exe
2292	spoolsv.exe
2008	explorer.exe
2008	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 28 IoCs

Processes:

783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe783dce01685a119f8d228a028034bd9e_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

description	pid	process	target process
PID 2168 set thread context of 2240	2168	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2240 set thread context of 2392	2240	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2444 set thread context of 772	2444	explorer.exe	explorer.exe
PID 772 set thread context of 2008	772	explorer.exe	explorer.exe
PID 2304 set thread context of 916	2304	spoolsv.exe	spoolsv.exe
PID 856 set thread context of 1784	856	spoolsv.exe	spoolsv.exe
PID 2164 set thread context of 2756	2164	spoolsv.exe	spoolsv.exe
PID 2912 set thread context of 1664	2912	spoolsv.exe	spoolsv.exe
PID 1608 set thread context of 2848	1608	spoolsv.exe	spoolsv.exe
PID 2272 set thread context of 2540	2272	spoolsv.exe	spoolsv.exe
PID 1372 set thread context of 2840	1372	spoolsv.exe	spoolsv.exe
PID 276 set thread context of 1816	276	spoolsv.exe	spoolsv.exe
PID 868 set thread context of 2332	868	spoolsv.exe	spoolsv.exe
PID 748 set thread context of 1772	748	spoolsv.exe	spoolsv.exe
PID 1468 set thread context of 2912	1468	spoolsv.exe	spoolsv.exe
PID 1956 set thread context of 1508	1956	spoolsv.exe	spoolsv.exe
PID 2216 set thread context of 2616	2216	spoolsv.exe	spoolsv.exe
PID 2520 set thread context of 2412	2520	spoolsv.exe	spoolsv.exe
PID 2408 set thread context of 744	2408	spoolsv.exe	spoolsv.exe
PID 324 set thread context of 1652	324	spoolsv.exe	spoolsv.exe
PID 924 set thread context of 2748	924	spoolsv.exe	spoolsv.exe
PID 684 set thread context of 3032	684	spoolsv.exe	spoolsv.exe
PID 3008 set thread context of 956	3008	spoolsv.exe	spoolsv.exe
PID 2292 set thread context of 2548	2292	spoolsv.exe	spoolsv.exe
PID 2424 set thread context of 476	2424	spoolsv.exe	spoolsv.exe
PID 2344 set thread context of 2144	2344	spoolsv.exe	spoolsv.exe
PID 1044 set thread context of 2176	1044	spoolsv.exe	spoolsv.exe
PID 1968 set thread context of 888	1968	spoolsv.exe	spoolsv.exe

Drops file in Windows directory 54 IoCs

Processes:

spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe783dce01685a119f8d228a028034bd9e_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe783dce01685a119f8d228a028034bd9e_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exe

description	ioc	process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

783dce01685a119f8d228a028034bd9e_JaffaCakes118.exeexplorer.exe

pid	process
2392	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe

Suspicious use of SetWindowsHookEx 33 IoCs

Processes:

783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe783dce01685a119f8d228a028034bd9e_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

pid	process
2168	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
2392	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
2392	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
2444	explorer.exe
2008	explorer.exe
2008	explorer.exe
2304	spoolsv.exe
2008	explorer.exe
2008	explorer.exe
856	spoolsv.exe
2164	spoolsv.exe
2912	spoolsv.exe
1608	spoolsv.exe
2272	spoolsv.exe
1372	spoolsv.exe
276	spoolsv.exe
868	spoolsv.exe
748	spoolsv.exe
1468	spoolsv.exe
1956	spoolsv.exe
2216	spoolsv.exe
2520	spoolsv.exe
2408	spoolsv.exe
324	spoolsv.exe
924	spoolsv.exe
684	spoolsv.exe
3008	spoolsv.exe
2292	spoolsv.exe
2424	spoolsv.exe
2344	spoolsv.exe
1044	spoolsv.exe
1968	spoolsv.exe
1564	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe783dce01685a119f8d228a028034bd9e_JaffaCakes118.exeexplorer.exeexplorer.exeexplorer.exespoolsv.exe

description	pid	process	target process
PID 2168 wrote to memory of 2240	2168	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2168 wrote to memory of 2240	2168	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2168 wrote to memory of 2240	2168	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2168 wrote to memory of 2240	2168	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2168 wrote to memory of 2240	2168	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2168 wrote to memory of 2240	2168	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2168 wrote to memory of 2240	2168	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2168 wrote to memory of 2240	2168	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2168 wrote to memory of 2240	2168	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2168 wrote to memory of 2240	2168	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2168 wrote to memory of 2240	2168	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2168 wrote to memory of 2240	2168	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2168 wrote to memory of 2240	2168	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2168 wrote to memory of 2240	2168	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2240 wrote to memory of 2232	2240	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	splwow64.exe
PID 2240 wrote to memory of 2232	2240	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	splwow64.exe
PID 2240 wrote to memory of 2232	2240	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	splwow64.exe
PID 2240 wrote to memory of 2232	2240	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	splwow64.exe
PID 2240 wrote to memory of 2392	2240	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2240 wrote to memory of 2392	2240	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2240 wrote to memory of 2392	2240	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2240 wrote to memory of 2392	2240	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2240 wrote to memory of 2392	2240	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2240 wrote to memory of 2392	2240	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
PID 2392 wrote to memory of 2444	2392	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	explorer.exe
PID 2392 wrote to memory of 2444	2392	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	explorer.exe
PID 2392 wrote to memory of 2444	2392	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	explorer.exe
PID 2392 wrote to memory of 2444	2392	783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe	explorer.exe
PID 2444 wrote to memory of 772	2444	explorer.exe	explorer.exe
PID 2444 wrote to memory of 772	2444	explorer.exe	explorer.exe
PID 2444 wrote to memory of 772	2444	explorer.exe	explorer.exe
PID 2444 wrote to memory of 772	2444	explorer.exe	explorer.exe
PID 2444 wrote to memory of 772	2444	explorer.exe	explorer.exe
PID 2444 wrote to memory of 772	2444	explorer.exe	explorer.exe
PID 2444 wrote to memory of 772	2444	explorer.exe	explorer.exe
PID 2444 wrote to memory of 772	2444	explorer.exe	explorer.exe
PID 2444 wrote to memory of 772	2444	explorer.exe	explorer.exe
PID 2444 wrote to memory of 772	2444	explorer.exe	explorer.exe
PID 2444 wrote to memory of 772	2444	explorer.exe	explorer.exe
PID 2444 wrote to memory of 772	2444	explorer.exe	explorer.exe
PID 2444 wrote to memory of 772	2444	explorer.exe	explorer.exe
PID 2444 wrote to memory of 772	2444	explorer.exe	explorer.exe
PID 772 wrote to memory of 2008	772	explorer.exe	explorer.exe
PID 772 wrote to memory of 2008	772	explorer.exe	explorer.exe
PID 772 wrote to memory of 2008	772	explorer.exe	explorer.exe
PID 772 wrote to memory of 2008	772	explorer.exe	explorer.exe
PID 772 wrote to memory of 2008	772	explorer.exe	explorer.exe
PID 772 wrote to memory of 2008	772	explorer.exe	explorer.exe
PID 2008 wrote to memory of 2304	2008	explorer.exe	spoolsv.exe
PID 2008 wrote to memory of 2304	2008	explorer.exe	spoolsv.exe
PID 2008 wrote to memory of 2304	2008	explorer.exe	spoolsv.exe
PID 2008 wrote to memory of 2304	2008	explorer.exe	spoolsv.exe
PID 2304 wrote to memory of 916	2304	spoolsv.exe	spoolsv.exe
PID 2304 wrote to memory of 916	2304	spoolsv.exe	spoolsv.exe
PID 2304 wrote to memory of 916	2304	spoolsv.exe	spoolsv.exe
PID 2304 wrote to memory of 916	2304	spoolsv.exe	spoolsv.exe
PID 2304 wrote to memory of 916	2304	spoolsv.exe	spoolsv.exe
PID 2304 wrote to memory of 916	2304	spoolsv.exe	spoolsv.exe
PID 2304 wrote to memory of 916	2304	spoolsv.exe	spoolsv.exe
PID 2304 wrote to memory of 916	2304	spoolsv.exe	spoolsv.exe
PID 2304 wrote to memory of 916	2304	spoolsv.exe	spoolsv.exe
PID 2304 wrote to memory of 916	2304	spoolsv.exe	spoolsv.exe
PID 2304 wrote to memory of 916	2304	spoolsv.exe	spoolsv.exe
PID 2304 wrote to memory of 916	2304	spoolsv.exe	spoolsv.exe

C:\Users\Admin\AppData\Local\Temp\783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168

C:\Users\Admin\AppData\Local\Temp\783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe"
2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
PID:2232

C:\Users\Admin\AppData\Local\Temp\783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\783dce01685a119f8d228a028034bd9e_JaffaCakes118.exe"
3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:772

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:916

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:3084

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:856

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1784

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2164

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2756

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2912

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1664

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:3896

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1608

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2848

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:3680

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2272

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2540

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1372

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2840

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:3244

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:276

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1816

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:868

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2332

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:4384

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:748

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1772

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1468

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2912

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:1008

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1956

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1508

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2216

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2616

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:3240

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2520

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2412

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2408

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:744

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:4240

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:324

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1652

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:924

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2748

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:684

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3032

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3008

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:956

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2292

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2548

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2424

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:476

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2344

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2144

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1044

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2176

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1968

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
- Executes dropped EXE
PID:888

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1564

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2868

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:2056

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1308

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:1504

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2004

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:1628

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:4964

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2656

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2644

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1468

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2800

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:616

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2928

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2300

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:5048

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1288

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2952

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2996

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2212

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1648

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2060

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1748

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2728

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2900

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2908

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1576

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2744

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2668

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:680

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1800

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:1808

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:4520

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1996

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:1028

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:824

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:1732

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2552

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:1268

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1340

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2472

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1604

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3044

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2024

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2136

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:4788

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2280

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:1152

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:4752

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
10⤵
PID:4804

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
11⤵
PID:932

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1720

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2996

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:3904

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1552

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:1908

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:944

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:1948

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:4068

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1696

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:1856

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1720

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:1864

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:920

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2904

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2612

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:1308

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1372

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2040

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1312

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:852

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2280

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2436

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2492

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2572

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1364

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:824

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3008

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2588

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:4452

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1604

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:1936

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2860

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2652

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2492

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:1276

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2200

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:1716

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2116

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:684

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1288

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:624

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:992

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2352

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:924

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2544

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:2084

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2780

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3008

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:1048

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1340

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:1472

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:992

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2020

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1668

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:1752

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:436

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2004

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:4896

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
10⤵
PID:4064

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
11⤵
PID:4444

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3148

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3248

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3312

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3372

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:1944

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3480

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3560

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:4284

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3644

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3700

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3804

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3868

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:4816

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3972

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:4028

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:4516

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:372

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3128

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3220

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3300

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:3528

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3408

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3488

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:4572

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3604

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3692

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3780

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3892

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:4352

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3960

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:4044

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:924

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3120

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3296

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3384

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:4264

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3408

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3552

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3608

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3840

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3920

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:4008

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:2820

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:1576

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3208

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3276

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3356

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3500

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3672

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3752

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3804

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:4052

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2468

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3224

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3260

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3468

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3636

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3708

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3816

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:3956

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3880

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3132

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3244

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3276

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3408

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3508

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:4012

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:4016

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:796

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3172

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3280

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3612

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3900

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3984

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:4088

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3360

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3512

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3660

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
9⤵
PID:2532

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3832

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:2084

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3784

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3444

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3512

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3764

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3408

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3900

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:436

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3832

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3180

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:4056

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3296

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3520

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:3732

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3408

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:4316

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:4336

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:4732

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:4624

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:4144

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:4900

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:4800

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:3568

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:5116

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
8⤵
PID:1536

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
7⤵
PID:5116

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

4

T1112

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini
Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System32\spool\drivers\x64\3\mxdwdui.BUD
Filesize
56KB

MD5
bd72dcf1083b6e22ccbfa0e8e27fb1e0

SHA1
3fd23d4f14da768da7b8364d74c54932d704e74e

SHA256
90f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1

SHA512
72360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562

Download Submit
C:\Windows\system\explorer.exe
Filesize
2.1MB

MD5
ba8b939c1ad10125820ea24045f01f95

SHA1
539f7add81a548883b0117bfe72cc2c41a7b1064

SHA256
2ec247a6539eb8093d4154c26ab288c4e435cfdfa6821453ff079abb03ffdb2b

SHA512
27655852f4569dd4213741137369b047880860703a66d1095dad9c6fcac6b1c2970968f9f5177cedc17bac74f4fe792cac39265e8ba2a06887c925f3d501465e

Download Submit
C:\Windows\system\spoolsv.exe
Filesize
1.2MB

MD5
0cbe4d3648bf7803a89e57a27d5b47f3

SHA1
250c92cf94e7380bdca30c9607bf0f17b23c5dda

SHA256
510dc9d25c193d5f9fb677fa3ab54a98befb864dc02d57f8d14f572836b29d40

SHA512
13cb14f0854253ba61c6c045f1a4cc819f2987d36e08d54857cfed67c081d7841f2fda895316caa5d4f23f4eb9dd82668f4cfb5ea4ac6277def269dc34dd2e08

Download Submit
\??\c:\windows\system\spoolsv.exe
Filesize
2.6MB

MD5
37d1bcba6d2fb20c8a7514878815c80d

SHA1
034c9e26fcba0ce64bb18921794c4279aceb7291

SHA256
e7bcfff4bcdb5376e031f3eb2a24ea58ef7c2bc281f9454173f680df3f4f1c04

SHA512
d5d83972b0f050a088707d054cea302981f9580df4b7ec2b0082db85012d90a671b2a5ebfa504407be83166bb7d607fbeed10e70eb7ea07a23a75ec8e844df44

Download Submit
\Windows\system\explorer.exe
Filesize
2.0MB

MD5
0bee96b76bfceb5a48b1af885d7b1d75

SHA1
c5fa8936747492cd747459bb5cc611fd436b276b

SHA256
344b87633f35bc8514dfc2132cf0ad9c61212635585bea6f9ff18c19279cb762

SHA512
8a34ee30e6bb772af162ef777318cd5eb70d5f5cee295a600703a329b586468213859029a800d72014e5e299c1436fa31814e47ec8cfac6d8f46ca8803c32417

Download Submit
\Windows\system\explorer.exe
Filesize
2.6MB

MD5
18e460a9ea044a511686a3d020b08665

SHA1
7b508607de06ef43fc30026dfc6c1ae72034e09d

SHA256
3f5e57e7468c2587850a6d8a401c06d8b8cef072e2124eaab7789b51594b5c61

SHA512
13d27bad3ffbb5385b5ff4e925e5d4d3f0ea17f1384a2d8becb091e7bae2a093d2db10c463c1e2089bc35374860c3788a7437c726df4b45fbddd1e50baf67eae

Download Submit
\Windows\system\spoolsv.exe
Filesize
1.1MB

MD5
513cf0f4c5d5749480a040bc1c4af038

SHA1
e1f98a4c7b61fa382b9c0156b93a561c5eac263b

SHA256
97e349926bfd2aba5f137b5701f0d77f2ec4289c193c67b5ed13274dc46345de

SHA512
38824621a95d67d6e015ec8fce11e601fcf47df087e4f5d2bfe795c912180f800cb056d0d9cd9dc16a36cfc39604c3a7d213999f54937126dafd844b2b74c3ce

Download Submit
memory/616-3962-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/772-55-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/772-57-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/772-76-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/772-84-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/916-104-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1008-4153-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2168-2-0x0000000000407000-0x0000000000408000-memory.dmp

Filesize
4KB

Download
memory/2240-34-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2240-24-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2240-4-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2240-6-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2240-7-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2240-5-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2240-3-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2392-30-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2392-26-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2392-58-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2392-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2392-32-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2444-51-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2444-56-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2532-4449-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3084-3866-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3240-3947-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3244-3918-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3680-3902-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3896-4262-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3956-4374-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4240-4014-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4264-4329-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4284-4108-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4384-3984-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4452-4075-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4516-4311-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4520-4248-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4752-4128-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4752-4030-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4816-4220-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4896-4431-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4964-4046-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5048-4119-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads