pony | 7a29123f6df6bca1b2c5b72506d40f536a00ac20f92b54fe08b6ec54b0f663fb

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe
Size 2.2MB
Sample240612-ph7m3svbma
SHA256 7a29123f6df6bca1b2c5b72506d40f536a00ac20f92b54fe08b6ec54b0f663fb
MD5 a0a69944b8356d922396a108113d4f05
SHA1 2232246b3b6a8284fe222927cfd62d5486a57ea6
SHA512 a99566969569c57fa0c58d9295adb2d3515a3128b3870419b7c13fdf6d5ba342ad5b9c9c6d94c16c611b7e1ce7af2b8ea2c400e57678465c3a630575b3c50a9d
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZB:0UzeyQMS4DqodCnoe+iitjWwwV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe	a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe	a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe

Executes dropped EXE 25 IoCs

pid	Process
2772	explorer.exe
1828	explorer.exe
4376	explorer.exe
3696	explorer.exe
1424	explorer.exe
1404	explorer.exe
2256	explorer.exe
5112	explorer.exe
5000	explorer.exe
4404	explorer.exe
1644	explorer.exe
4304	explorer.exe
4552	explorer.exe
2376	explorer.exe
3748	explorer.exe
1952	explorer.exe
4936	explorer.exe
1652	explorer.exe
1884	explorer.exe
4592	explorer.exe
4436	explorer.exe
2296	explorer.exe
2576	explorer.exe
4232	explorer.exe
1216	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 57 IoCs

description	pid	Process	procid_target
PID 1620 set thread context of 4712	1620	a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe	86
PID 2772 set thread context of 1828	2772	explorer.exe	95
PID 4880 set thread context of 2668	4880	spoolsv.exe	127
PID 1912 set thread context of 4068	1912	spoolsv.exe	129
PID 4648 set thread context of 4796	4648	spoolsv.exe	130
PID 724 set thread context of 4884	724	spoolsv.exe	132
PID 1036 set thread context of 4456	1036	spoolsv.exe	133
PID 2552 set thread context of 3996	2552	spoolsv.exe	134
PID 4568 set thread context of 2416	4568	spoolsv.exe	135
PID 1620 set thread context of 4288	1620	spoolsv.exe	136
PID 1560 set thread context of 4324	1560	spoolsv.exe	138
PID 1092 set thread context of 3940	1092	spoolsv.exe	139
PID 232 set thread context of 4416	232	spoolsv.exe	140
PID 3564 set thread context of 1164	3564	spoolsv.exe	142
PID 884 set thread context of 2492	884	spoolsv.exe	143
PID 1728 set thread context of 3976	1728	spoolsv.exe	144
PID 1836 set thread context of 3124	1836	spoolsv.exe	145
PID 1588 set thread context of 3016	1588	spoolsv.exe	148
PID 3504 set thread context of 4424	3504	spoolsv.exe	149
PID 4844 set thread context of 1708	4844	spoolsv.exe	150
PID 1388 set thread context of 1396	1388	spoolsv.exe	151
PID 1624 set thread context of 1536	1624	spoolsv.exe	153
PID 5104 set thread context of 3220	5104	spoolsv.exe	155
PID 4904 set thread context of 3228	4904	spoolsv.exe	156
PID 2108 set thread context of 1128	2108	spoolsv.exe	157
PID 3612 set thread context of 3188	3612	spoolsv.exe	159
PID 4296 set thread context of 3368	4296	spoolsv.exe	161
PID 4640 set thread context of 1736	4640	spoolsv.exe	162
PID 1632 set thread context of 1044	1632	spoolsv.exe	163
PID 1020 set thread context of 4564	1020	spoolsv.exe	165
PID 680 set thread context of 2488	680	spoolsv.exe	167
PID 3208 set thread context of 4200	3208	spoolsv.exe	168
PID 3652 set thread context of 4364	3652	spoolsv.exe	171
PID 4376 set thread context of 4404	4376	explorer.exe	176
PID 1272 set thread context of 4732	1272	spoolsv.exe	181
PID 3696 set thread context of 4304	3696	explorer.exe	185
PID 4912 set thread context of 1576	4912	spoolsv.exe	186
PID 1424 set thread context of 2376	1424	explorer.exe	191
PID 1472 set thread context of 5080	1472	spoolsv.exe	192
PID 464 set thread context of 3676	464	spoolsv.exe	196
PID 1404 set thread context of 4936	1404	explorer.exe	199
PID 3000 set thread context of 5028	3000	spoolsv.exe	202
PID 2256 set thread context of 1884	2256	explorer.exe	204
PID 4380 set thread context of 3780	4380	spoolsv.exe	206
PID 5112 set thread context of 4436	5112	explorer.exe	208
PID 324 set thread context of 5040	324	spoolsv.exe	210
PID 1856 set thread context of 1820	1856	spoolsv.exe	211
PID 5000 set thread context of 2576	5000	explorer.exe	213
PID 2584 set thread context of 3640	2584	spoolsv.exe	215
PID 3688 set thread context of 3044	3688	spoolsv.exe	216
PID 3040 set thread context of 3872	3040	spoolsv.exe	217
PID 4496 set thread context of 1924	4496	spoolsv.exe	220
PID 4572 set thread context of 3212	4572	spoolsv.exe	221
PID 3596 set thread context of 3452	3596	spoolsv.exe	222
PID 2372 set thread context of 1280	2372	spoolsv.exe	223
PID 1644 set thread context of 1216	1644	explorer.exe	224
PID 3908 set thread context of 2000	3908	spoolsv.exe	225

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4712	a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe
4712	a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4712	a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe
4712	a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe
2668	spoolsv.exe
2668	spoolsv.exe
4068	spoolsv.exe
4068	spoolsv.exe
4796	spoolsv.exe
4796	spoolsv.exe
4884	spoolsv.exe
4884	spoolsv.exe
4456	spoolsv.exe
4456	spoolsv.exe
3996	spoolsv.exe
3996	spoolsv.exe
2416	spoolsv.exe
2416	spoolsv.exe
4288	spoolsv.exe
4288	spoolsv.exe
4324	spoolsv.exe
4324	spoolsv.exe
3940	spoolsv.exe
3940	spoolsv.exe
4416	spoolsv.exe
4416	spoolsv.exe
1164	spoolsv.exe
1164	spoolsv.exe
2492	spoolsv.exe
2492	spoolsv.exe
3976	spoolsv.exe
3976	spoolsv.exe
3124	spoolsv.exe
3124	spoolsv.exe
3016	spoolsv.exe
3016	spoolsv.exe
4424	spoolsv.exe
4424	spoolsv.exe
1708	spoolsv.exe
1708	spoolsv.exe
1396	spoolsv.exe
1396	spoolsv.exe
1536	spoolsv.exe
1536	spoolsv.exe
3220	spoolsv.exe
3220	spoolsv.exe
3228	spoolsv.exe
3228	spoolsv.exe
1128	spoolsv.exe
1128	spoolsv.exe
3188	spoolsv.exe
3188	spoolsv.exe
3368	spoolsv.exe
3368	spoolsv.exe
1736	spoolsv.exe
1736	spoolsv.exe
1044	spoolsv.exe
1044	spoolsv.exe
4564	spoolsv.exe
4564	spoolsv.exe
2488	spoolsv.exe
2488	spoolsv.exe
4200	spoolsv.exe
4200	spoolsv.exe
4364	spoolsv.exe
4364	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 3992	1620	a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe	81
PID 1620 wrote to memory of 3992	1620	a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe	81
PID 1620 wrote to memory of 4712	1620	a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe	86
PID 1620 wrote to memory of 4712	1620	a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe	86
PID 1620 wrote to memory of 4712	1620	a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe	86
PID 1620 wrote to memory of 4712	1620	a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe	86
PID 1620 wrote to memory of 4712	1620	a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe	86
PID 4712 wrote to memory of 2772	4712	a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe	87
PID 4712 wrote to memory of 2772	4712	a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe	87
PID 4712 wrote to memory of 2772	4712	a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe	87
PID 2772 wrote to memory of 1828	2772	explorer.exe	95
PID 2772 wrote to memory of 1828	2772	explorer.exe	95
PID 2772 wrote to memory of 1828	2772	explorer.exe	95
PID 2772 wrote to memory of 1828	2772	explorer.exe	95
PID 2772 wrote to memory of 1828	2772	explorer.exe	95
PID 4880 wrote to memory of 2668	4880	spoolsv.exe	127
PID 4880 wrote to memory of 2668	4880	spoolsv.exe	127
PID 4880 wrote to memory of 2668	4880	spoolsv.exe	127
PID 4880 wrote to memory of 2668	4880	spoolsv.exe	127
PID 4880 wrote to memory of 2668	4880	spoolsv.exe	127
PID 2668 wrote to memory of 4376	2668	spoolsv.exe	128
PID 2668 wrote to memory of 4376	2668	spoolsv.exe	128
PID 2668 wrote to memory of 4376	2668	spoolsv.exe	128
PID 1912 wrote to memory of 4068	1912	spoolsv.exe	129
PID 1912 wrote to memory of 4068	1912	spoolsv.exe	129
PID 1912 wrote to memory of 4068	1912	spoolsv.exe	129
PID 1912 wrote to memory of 4068	1912	spoolsv.exe	129
PID 1912 wrote to memory of 4068	1912	spoolsv.exe	129
PID 4648 wrote to memory of 4796	4648	spoolsv.exe	130
PID 4648 wrote to memory of 4796	4648	spoolsv.exe	130
PID 4648 wrote to memory of 4796	4648	spoolsv.exe	130
PID 4648 wrote to memory of 4796	4648	spoolsv.exe	130
PID 4648 wrote to memory of 4796	4648	spoolsv.exe	130
PID 724 wrote to memory of 4884	724	spoolsv.exe	132
PID 724 wrote to memory of 4884	724	spoolsv.exe	132
PID 724 wrote to memory of 4884	724	spoolsv.exe	132
PID 724 wrote to memory of 4884	724	spoolsv.exe	132
PID 724 wrote to memory of 4884	724	spoolsv.exe	132
PID 1036 wrote to memory of 4456	1036	spoolsv.exe	133
PID 1036 wrote to memory of 4456	1036	spoolsv.exe	133
PID 1036 wrote to memory of 4456	1036	spoolsv.exe	133
PID 1036 wrote to memory of 4456	1036	spoolsv.exe	133
PID 1036 wrote to memory of 4456	1036	spoolsv.exe	133
PID 2552 wrote to memory of 3996	2552	spoolsv.exe	134
PID 2552 wrote to memory of 3996	2552	spoolsv.exe	134
PID 2552 wrote to memory of 3996	2552	spoolsv.exe	134
PID 2552 wrote to memory of 3996	2552	spoolsv.exe	134
PID 2552 wrote to memory of 3996	2552	spoolsv.exe	134
PID 4568 wrote to memory of 2416	4568	spoolsv.exe	135
PID 4568 wrote to memory of 2416	4568	spoolsv.exe	135
PID 4568 wrote to memory of 2416	4568	spoolsv.exe	135
PID 4568 wrote to memory of 2416	4568	spoolsv.exe	135
PID 4568 wrote to memory of 2416	4568	spoolsv.exe	135
PID 1620 wrote to memory of 4288	1620	spoolsv.exe	136
PID 1620 wrote to memory of 4288	1620	spoolsv.exe	136
PID 1620 wrote to memory of 4288	1620	spoolsv.exe	136
PID 1620 wrote to memory of 4288	1620	spoolsv.exe	136
PID 1620 wrote to memory of 4288	1620	spoolsv.exe	136
PID 4288 wrote to memory of 3696	4288	spoolsv.exe	137
PID 4288 wrote to memory of 3696	4288	spoolsv.exe	137
PID 4288 wrote to memory of 3696	4288	spoolsv.exe	137
PID 1560 wrote to memory of 4324	1560	spoolsv.exe	138
PID 1560 wrote to memory of 4324	1560	spoolsv.exe	138
PID 1560 wrote to memory of 4324	1560	spoolsv.exe	138

C:\Users\Admin\AppData\Local\Temp\a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3992
- C:\Users\Admin\AppData\Local\Temp\a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a0a69944b8356d922396a108113d4f05_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4712
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      PID:1828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4880
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2668
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4376
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        Executes dropped EXE
        
        PID:4404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1912
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4648
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:724
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1620
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4288
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3696
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        Executes dropped EXE
        
        PID:4304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:232
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1728
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3124
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1424
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        Executes dropped EXE
        
        PID:2376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1588
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3504
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4844
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1624
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1536
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1404
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        Executes dropped EXE
        
        PID:4936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3612
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3188
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2256
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        Executes dropped EXE
        
        PID:1884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4296
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1632
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4564
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5112
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        Executes dropped EXE
        
        PID:4436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:680
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3652
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4364
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5000
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        Executes dropped EXE
        
        PID:2576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1272
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4732
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1644
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        Executes dropped EXE
        
        PID:1216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4912
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1576
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1472
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5080
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:464
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3676
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5028
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3780
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        
        PID:4592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:324
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1856
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1820
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3872
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4232
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2372
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3908
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2000
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 41a60763e676f4da3e59a8058f9ddbb54091ecaf71f22e5267564ed31e230b47
MD5 8a43b88ac01c04e3e3fdf868012332b1
SHA1 05042474acf5f3efaf28ad6e1346201ea0f9579f
SHA512 8bcc70ac1778f798f660f39f1183cab11baae6d12715b9b002ed57575c11eeab024555806b9dcaa75880fd6951469930b2e9f237abb866b308561191eebbe453
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZr:0UzeyQMS4DqodCnoe+iitjWww3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/232-1558-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/724-2122-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/724-1080-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/884-1560-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1036-1246-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1044-3012-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1092-1390-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1164-2373-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1216-5314-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1280-5302-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1388-1922-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1396-2620-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1536-2749-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1536-2900-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1560-1389-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1576-4283-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1576-4144-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1588-1726-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1620-28-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1620-1388-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1620-0-0x0000000002570000-0x0000000002571000-memory.dmp

Download

memory/1620-23-0x0000000002570000-0x0000000002571000-memory.dmp

Download

memory/1620-21-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1624-2011-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1708-2600-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1728-1724-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1736-2941-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1820-5163-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1820-5005-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1828-99-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1828-877-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1836-1725-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1884-4802-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1912-1078-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1912-2022-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1924-5270-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1924-5273-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2000-5502-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2000-5363-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2108-2061-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2376-4348-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2416-2158-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2488-3119-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2492-2382-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2552-1247-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2576-5016-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2668-2197-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2668-2013-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2772-95-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2772-100-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3044-5104-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3124-2484-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3188-3066-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3188-2923-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3228-2768-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3368-2933-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3368-2929-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3452-5292-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3504-1920-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3564-1559-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3676-4561-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3676-4700-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3780-4881-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3780-4984-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3872-5178-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3940-2270-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3976-2392-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3996-2145-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4068-2021-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4068-2024-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4200-3167-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4288-2250-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4304-4128-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4324-2259-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4364-3433-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4364-3303-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4404-3581-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4416-2283-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4436-4892-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4456-2135-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4456-2139-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4564-3111-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4564-3223-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4568-1248-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4648-2032-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4648-1079-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4712-82-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/4712-84-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4712-25-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4712-24-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4732-4016-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4732-3868-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4796-2044-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4844-1921-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4880-2008-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4880-878-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4884-2127-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4904-2019-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4936-4632-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5028-4793-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5040-4951-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5080-4472-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5080-4355-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5104-2012-0x0000000000400000-0x00000000005D3000-memory.dmp

Download