pony | ae0f4299a9b9dddfa754dfbde3896205ca550e2b73b3b3f7b26d02187a735945

Analysis

max time kernel
112s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe
Size 2.2MB
Sample240612-2772csvbqb
SHA256 ae0f4299a9b9dddfa754dfbde3896205ca550e2b73b3b3f7b26d02187a735945
MD5 a2e0facee51cd1197c24fd0fdd3cbb42
SHA1 776597d54c483b22ecbf65d411d3b4468aaf4b63
SHA512 d2a761972c1f5433a08140e2d6b1e94e3280c824318f0d541bec05281f8f73f047631a5f4bac90a2f66216a00040362f418827b03519e0f658244539d76d0151
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ0:0UzeyQMS4DqodCnoe+iitjWwwQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe	a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe	a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
3600	explorer.exe
4800	explorer.exe
4272	spoolsv.exe
4444	spoolsv.exe
2292	spoolsv.exe
720	spoolsv.exe
4600	spoolsv.exe
3284	spoolsv.exe
1504	spoolsv.exe
2424	spoolsv.exe
4468	spoolsv.exe
3600	spoolsv.exe
1368	spoolsv.exe
384	spoolsv.exe
2392	spoolsv.exe
1544	spoolsv.exe
1188	spoolsv.exe
1072	spoolsv.exe
2848	spoolsv.exe
1856	spoolsv.exe
3280	spoolsv.exe
4356	spoolsv.exe
2568	spoolsv.exe
1148	spoolsv.exe
4900	spoolsv.exe
3212	spoolsv.exe
1928	explorer.exe
1664	spoolsv.exe
2088	spoolsv.exe
4492	spoolsv.exe
2000	spoolsv.exe
2700	explorer.exe
4980	spoolsv.exe
3184	spoolsv.exe
2220	spoolsv.exe
828	explorer.exe
984	spoolsv.exe
4560	spoolsv.exe
1644	spoolsv.exe
1460	explorer.exe
1432	spoolsv.exe
544	spoolsv.exe
3776	spoolsv.exe
5032	explorer.exe
4496	spoolsv.exe
3160	spoolsv.exe
1448	spoolsv.exe
4976	explorer.exe
1932	spoolsv.exe
5080	spoolsv.exe
4836	spoolsv.exe
3968	spoolsv.exe
3692	explorer.exe
1044	spoolsv.exe
5048	spoolsv.exe
1184	spoolsv.exe
4500	explorer.exe
1052	spoolsv.exe
1436	spoolsv.exe
3792	spoolsv.exe
2912	explorer.exe
4788	spoolsv.exe
2960	spoolsv.exe
4368	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 23 IoCs

description	pid	Process	procid_target
PID 4996 set thread context of 3444	4996	a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe	89
PID 3600 set thread context of 4800	3600	explorer.exe	94
PID 4272 set thread context of 3212	4272	spoolsv.exe	118
PID 4444 set thread context of 2088	4444	spoolsv.exe	121
PID 2292 set thread context of 2000	2292	spoolsv.exe	123
PID 720 set thread context of 4980	720	spoolsv.exe	125
PID 4600 set thread context of 2220	4600	spoolsv.exe	127
PID 3284 set thread context of 984	3284	spoolsv.exe	129
PID 1504 set thread context of 1644	1504	spoolsv.exe	131
PID 2424 set thread context of 544	2424	spoolsv.exe	134
PID 4468 set thread context of 3776	4468	spoolsv.exe	135
PID 3600 set thread context of 3160	3600	spoolsv.exe	138
PID 1368 set thread context of 1448	1368	spoolsv.exe	139
PID 384 set thread context of 5080	384	spoolsv.exe	142
PID 2392 set thread context of 3968	2392	spoolsv.exe	144
PID 1544 set thread context of 1044	1544	spoolsv.exe	146
PID 1188 set thread context of 1184	1188	spoolsv.exe	148
PID 1072 set thread context of 1436	1072	spoolsv.exe	151
PID 2848 set thread context of 3792	2848	spoolsv.exe	152
PID 1856 set thread context of 2960	1856	spoolsv.exe	155
PID 3280 set thread context of 2400	3280	spoolsv.exe	157
PID 4356 set thread context of 1408	4356	spoolsv.exe	159
PID 2568 set thread context of 3008	2568	spoolsv.exe	161

Drops file in Windows directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3444	a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe
3444	a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe

Suspicious use of SetWindowsHookEx 48 IoCs

pid	Process
3444	a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe
3444	a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
4800	explorer.exe
3212	spoolsv.exe
3212	spoolsv.exe
2088	spoolsv.exe
2088	spoolsv.exe
2000	spoolsv.exe
2000	spoolsv.exe
4980	spoolsv.exe
4980	spoolsv.exe
2220	spoolsv.exe
2220	spoolsv.exe
984	spoolsv.exe
984	spoolsv.exe
1644	spoolsv.exe
1644	spoolsv.exe
544	spoolsv.exe
544	spoolsv.exe
3776	spoolsv.exe
3776	spoolsv.exe
3160	spoolsv.exe
3160	spoolsv.exe
1448	spoolsv.exe
1448	spoolsv.exe
5080	spoolsv.exe
5080	spoolsv.exe
3968	spoolsv.exe
3968	spoolsv.exe
1044	spoolsv.exe
1044	spoolsv.exe
1184	spoolsv.exe
1184	spoolsv.exe
1436	spoolsv.exe
1436	spoolsv.exe
3792	spoolsv.exe
3792	spoolsv.exe
2960	spoolsv.exe
2960	spoolsv.exe
2400	spoolsv.exe
2400	spoolsv.exe
1408	spoolsv.exe
1408	spoolsv.exe
3008	spoolsv.exe
3008	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 704	4996	a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe	86
PID 4996 wrote to memory of 704	4996	a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe	86
PID 4996 wrote to memory of 3444	4996	a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe	89
PID 4996 wrote to memory of 3444	4996	a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe	89
PID 4996 wrote to memory of 3444	4996	a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe	89
PID 4996 wrote to memory of 3444	4996	a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe	89
PID 4996 wrote to memory of 3444	4996	a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe	89
PID 3444 wrote to memory of 3600	3444	a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe	90
PID 3444 wrote to memory of 3600	3444	a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe	90
PID 3444 wrote to memory of 3600	3444	a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe	90
PID 3600 wrote to memory of 4800	3600	explorer.exe	94
PID 3600 wrote to memory of 4800	3600	explorer.exe	94
PID 3600 wrote to memory of 4800	3600	explorer.exe	94
PID 3600 wrote to memory of 4800	3600	explorer.exe	94
PID 3600 wrote to memory of 4800	3600	explorer.exe	94
PID 4800 wrote to memory of 4272	4800	explorer.exe	95
PID 4800 wrote to memory of 4272	4800	explorer.exe	95
PID 4800 wrote to memory of 4272	4800	explorer.exe	95
PID 4800 wrote to memory of 4444	4800	explorer.exe	96
PID 4800 wrote to memory of 4444	4800	explorer.exe	96
PID 4800 wrote to memory of 4444	4800	explorer.exe	96
PID 4800 wrote to memory of 2292	4800	explorer.exe	97
PID 4800 wrote to memory of 2292	4800	explorer.exe	97
PID 4800 wrote to memory of 2292	4800	explorer.exe	97
PID 4800 wrote to memory of 720	4800	explorer.exe	98
PID 4800 wrote to memory of 720	4800	explorer.exe	98
PID 4800 wrote to memory of 720	4800	explorer.exe	98
PID 4800 wrote to memory of 4600	4800	explorer.exe	99
PID 4800 wrote to memory of 4600	4800	explorer.exe	99
PID 4800 wrote to memory of 4600	4800	explorer.exe	99
PID 4800 wrote to memory of 3284	4800	explorer.exe	100
PID 4800 wrote to memory of 3284	4800	explorer.exe	100
PID 4800 wrote to memory of 3284	4800	explorer.exe	100
PID 4800 wrote to memory of 1504	4800	explorer.exe	101
PID 4800 wrote to memory of 1504	4800	explorer.exe	101
PID 4800 wrote to memory of 1504	4800	explorer.exe	101
PID 4800 wrote to memory of 2424	4800	explorer.exe	102
PID 4800 wrote to memory of 2424	4800	explorer.exe	102
PID 4800 wrote to memory of 2424	4800	explorer.exe	102
PID 4800 wrote to memory of 4468	4800	explorer.exe	103
PID 4800 wrote to memory of 4468	4800	explorer.exe	103
PID 4800 wrote to memory of 4468	4800	explorer.exe	103
PID 4800 wrote to memory of 3600	4800	explorer.exe	104
PID 4800 wrote to memory of 3600	4800	explorer.exe	104
PID 4800 wrote to memory of 3600	4800	explorer.exe	104
PID 4800 wrote to memory of 1368	4800	explorer.exe	105
PID 4800 wrote to memory of 1368	4800	explorer.exe	105
PID 4800 wrote to memory of 1368	4800	explorer.exe	105
PID 4800 wrote to memory of 384	4800	explorer.exe	106
PID 4800 wrote to memory of 384	4800	explorer.exe	106
PID 4800 wrote to memory of 384	4800	explorer.exe	106
PID 4800 wrote to memory of 2392	4800	explorer.exe	107
PID 4800 wrote to memory of 2392	4800	explorer.exe	107
PID 4800 wrote to memory of 2392	4800	explorer.exe	107
PID 4800 wrote to memory of 1544	4800	explorer.exe	108
PID 4800 wrote to memory of 1544	4800	explorer.exe	108
PID 4800 wrote to memory of 1544	4800	explorer.exe	108
PID 4800 wrote to memory of 1188	4800	explorer.exe	109
PID 4800 wrote to memory of 1188	4800	explorer.exe	109
PID 4800 wrote to memory of 1188	4800	explorer.exe	109
PID 4800 wrote to memory of 1072	4800	explorer.exe	110
PID 4800 wrote to memory of 1072	4800	explorer.exe	110
PID 4800 wrote to memory of 1072	4800	explorer.exe	110
PID 4800 wrote to memory of 2848	4800	explorer.exe	111

C:\Users\Admin\AppData\Local\Temp\a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:704
- C:\Users\Admin\AppData\Local\Temp\a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a2e0facee51cd1197c24fd0fdd3cbb42_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3444
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4272
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3212
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1928
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2088
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2000
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2700
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:720
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4600
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2220
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:828
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3284
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1504
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1644
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1460
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4468
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3776
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5032
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3600
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1368
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1448
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4976
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:384
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3968
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3692
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1188
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1184
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4500
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1072
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2848
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3792
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2912
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1856
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3280
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2400
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3956
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4356
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3008
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2984
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4900
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1664
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4968
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3836
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2432
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2728
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3184
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1752
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5112
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:500
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1508
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1432
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3052
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4176
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:748
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1932
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4972
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5048
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:644
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1800
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4788
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4368
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4736
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3404
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3124
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3924
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3372
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2772
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3192
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 e5113e0fa62ec8257c353c6e43ba8268f6218a9e7c746a85f63ad80f43f2ba3d
MD5 1c6f9598a0eda7b852b1743b14322555
SHA1 c56474b45b8f0284dc8e2bfa456bb6456a82b17f
SHA512 c453f4133c61764a2bb294118707498a91ddf8116b151e5e9201bab5229fb4cd1e79b1c7085d0088e9b0a3ee866edbf73aa4a6aaa12050789f54dcf59560841d
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZS:0UzeyQMS4DqodCnoe+iitjWwwu
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 44ec69dd8682668e7935df783242dc4f6de19aab94fbbfa10d3c8c227d37182b
MD5 c4ecb8f937959381b15e4ac8e75bce61
SHA1 56481c067b8e06bba5b33362dc81bebc7742ac82
SHA512 55a0207c328f231628565fc383097ce3654f57971c24260f2abeb37bd6f0e8874386d64932b2ea6a2cd1d51c850f279459cf141607dd464baf201caa87b1c731
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZM:0UzeyQMS4DqodCnoe+iitjWwwo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/384-1361-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/500-4046-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/500-3898-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/544-2124-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/644-4726-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/644-4583-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/720-1699-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/720-879-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/748-4214-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/748-4354-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/964-5167-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/984-1841-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1036-4465-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1036-4460-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1044-2533-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1044-2536-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1072-1586-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1184-2708-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1184-2829-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1188-1522-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1368-1233-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1408-3108-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1436-2794-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1448-2481-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1448-2348-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1504-1015-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1544-1521-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1612-5623-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1628-3919-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1644-2180-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1644-2036-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1752-3853-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1752-3735-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1800-4743-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1800-4887-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1856-1696-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1872-3745-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1988-3612-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2000-1690-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2000-1814-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2088-1587-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2220-1832-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2220-2017-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2292-756-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2292-1687-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2392-1362-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2400-3211-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2400-3096-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2424-1133-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2432-3601-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2432-3715-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2456-3309-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2552-4593-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2772-5587-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2848-1689-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2900-3494-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2960-2935-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3008-3369-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3008-3233-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3052-4197-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3052-4064-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3136-5835-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3160-2256-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3192-5813-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3192-5978-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3212-1667-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3212-1523-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3284-1014-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3308-5845-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3372-5471-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3372-5568-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3404-5080-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3444-51-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3444-84-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3444-82-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/3444-49-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3600-1232-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3600-96-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3600-90-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3664-3346-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3776-2320-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3776-2198-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3792-3004-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3792-2852-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3796-5825-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3888-4756-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3924-5449-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3924-5301-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3968-2526-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3968-2690-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3988-4814-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4272-612-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4272-1513-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4408-4307-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4444-755-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4444-1589-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4468-1134-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4600-880-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4736-4907-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4736-5060-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4800-611-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4800-95-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4848-4135-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4960-5480-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4968-3483-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4968-3551-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4972-4563-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4972-4454-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4980-1701-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4980-1697-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4984-4917-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4996-46-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4996-48-0x0000000002230000-0x0000000002231000-memory.dmp

Download

memory/4996-0-0x0000000002230000-0x0000000002231000-memory.dmp

Download

memory/4996-52-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5080-2412-0x0000000000400000-0x000000000043E000-memory.dmp

Download