pony | 6771251e2c5a388036cc254ddf4b42b51f44f714fb3907a22b47453c5e055835

Analysis

max time kernel
117s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 04:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe
Size 2.2MB
Sample240613-ff8b6avdjc
SHA256 6771251e2c5a388036cc254ddf4b42b51f44f714fb3907a22b47453c5e055835
MD5 a3df5b8dd6f38344e4d85c53e932b708
SHA1 df1166823681b06c2491f370251afa1891f97001
SHA512 ef2323bdc545b38e0ca0df1fa2ff60282b1d2a4914918ac4c0637e610dd22e74e29edbd69338f856d20d4dc3a2d5351082dfabc5c62ba8c7476ba1a10b235049
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ3:0UzeyQMS4DqodCnoe+iitjWwwz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe	a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe	a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
3504	explorer.exe
4172	explorer.exe
1140	spoolsv.exe
3380	spoolsv.exe
4516	spoolsv.exe
4532	spoolsv.exe
4568	spoolsv.exe
2368	spoolsv.exe
876	spoolsv.exe
1824	spoolsv.exe
3912	spoolsv.exe
3992	spoolsv.exe
2124	spoolsv.exe
4028	spoolsv.exe
3060	spoolsv.exe
1864	spoolsv.exe
4980	spoolsv.exe
3840	spoolsv.exe
3888	spoolsv.exe
1092	spoolsv.exe
220	spoolsv.exe
664	spoolsv.exe
4560	spoolsv.exe
4112	spoolsv.exe
2336	spoolsv.exe
3168	spoolsv.exe
540	spoolsv.exe
3740	explorer.exe
3612	spoolsv.exe
2196	spoolsv.exe
4800	spoolsv.exe
1704	explorer.exe
1064	spoolsv.exe
2524	spoolsv.exe
2672	spoolsv.exe
1224	spoolsv.exe
4976	explorer.exe
3592	spoolsv.exe
2292	spoolsv.exe
4212	spoolsv.exe
2896	explorer.exe
4760	spoolsv.exe
4540	spoolsv.exe
512	spoolsv.exe
3272	spoolsv.exe
984	explorer.exe
4396	spoolsv.exe
5024	spoolsv.exe
2912	spoolsv.exe
4588	explorer.exe
4972	spoolsv.exe
3796	spoolsv.exe
3108	spoolsv.exe
3416	explorer.exe
1544	spoolsv.exe
3100	spoolsv.exe
3872	spoolsv.exe
2900	explorer.exe
1280	spoolsv.exe
2540	spoolsv.exe
4508	spoolsv.exe
2544	explorer.exe
4408	spoolsv.exe
1836	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 27 IoCs

description	pid	Process	procid_target
PID 2772 set thread context of 4816	2772	a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe	87
PID 3504 set thread context of 4172	3504	explorer.exe	92
PID 1140 set thread context of 540	1140	spoolsv.exe	117
PID 3380 set thread context of 2196	3380	spoolsv.exe	120
PID 4516 set thread context of 4800	4516	spoolsv.exe	121
PID 4532 set thread context of 1064	4532	spoolsv.exe	123
PID 4568 set thread context of 2672	4568	spoolsv.exe	125
PID 2368 set thread context of 1224	2368	spoolsv.exe	126
PID 876 set thread context of 2292	876	spoolsv.exe	129
PID 1824 set thread context of 4212	1824	spoolsv.exe	130
PID 3912 set thread context of 4540	3912	spoolsv.exe	133
PID 3992 set thread context of 3272	3992	spoolsv.exe	135
PID 2124 set thread context of 4396	2124	spoolsv.exe	137
PID 4028 set thread context of 2912	4028	spoolsv.exe	139
PID 3060 set thread context of 4972	3060	spoolsv.exe	141
PID 1864 set thread context of 3108	1864	spoolsv.exe	143
PID 4980 set thread context of 1544	4980	spoolsv.exe	145
PID 3840 set thread context of 3872	3840	spoolsv.exe	147
PID 3888 set thread context of 2540	3888	spoolsv.exe	150
PID 1092 set thread context of 4508	1092	spoolsv.exe	151
PID 220 set thread context of 4408	220	spoolsv.exe	153
PID 664 set thread context of 4260	664	spoolsv.exe	155
PID 4560 set thread context of 4528	4560	spoolsv.exe	158
PID 4112 set thread context of 2156	4112	spoolsv.exe	159
PID 2336 set thread context of 3996	2336	spoolsv.exe	160
PID 3168 set thread context of 4452	3168	spoolsv.exe	163
PID 3740 set thread context of 1580	3740	explorer.exe	166

Drops file in Windows directory 53 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4816	a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe
4816	a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe

Suspicious use of SetWindowsHookEx 56 IoCs

pid	Process
4816	a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe
4816	a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
4172	explorer.exe
540	spoolsv.exe
540	spoolsv.exe
2196	spoolsv.exe
2196	spoolsv.exe
4800	spoolsv.exe
4800	spoolsv.exe
1064	spoolsv.exe
1064	spoolsv.exe
2672	spoolsv.exe
2672	spoolsv.exe
1224	spoolsv.exe
1224	spoolsv.exe
2292	spoolsv.exe
2292	spoolsv.exe
4212	spoolsv.exe
4212	spoolsv.exe
4540	spoolsv.exe
4540	spoolsv.exe
3272	spoolsv.exe
3272	spoolsv.exe
4396	spoolsv.exe
4396	spoolsv.exe
2912	spoolsv.exe
2912	spoolsv.exe
4972	spoolsv.exe
4972	spoolsv.exe
3108	spoolsv.exe
3108	spoolsv.exe
1544	spoolsv.exe
1544	spoolsv.exe
3872	spoolsv.exe
3872	spoolsv.exe
2540	spoolsv.exe
2540	spoolsv.exe
4508	spoolsv.exe
4508	spoolsv.exe
4408	spoolsv.exe
4408	spoolsv.exe
4260	spoolsv.exe
4260	spoolsv.exe
4528	spoolsv.exe
4528	spoolsv.exe
2156	spoolsv.exe
2156	spoolsv.exe
3996	spoolsv.exe
3996	spoolsv.exe
4452	spoolsv.exe
4452	spoolsv.exe
1580	explorer.exe
1580	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2728	2772	a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe	82
PID 2772 wrote to memory of 2728	2772	a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe	82
PID 2772 wrote to memory of 4816	2772	a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe	87
PID 2772 wrote to memory of 4816	2772	a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe	87
PID 2772 wrote to memory of 4816	2772	a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe	87
PID 2772 wrote to memory of 4816	2772	a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe	87
PID 2772 wrote to memory of 4816	2772	a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe	87
PID 4816 wrote to memory of 3504	4816	a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe	88
PID 4816 wrote to memory of 3504	4816	a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe	88
PID 4816 wrote to memory of 3504	4816	a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe	88
PID 3504 wrote to memory of 4172	3504	explorer.exe	92
PID 3504 wrote to memory of 4172	3504	explorer.exe	92
PID 3504 wrote to memory of 4172	3504	explorer.exe	92
PID 3504 wrote to memory of 4172	3504	explorer.exe	92
PID 3504 wrote to memory of 4172	3504	explorer.exe	92
PID 4172 wrote to memory of 1140	4172	explorer.exe	93
PID 4172 wrote to memory of 1140	4172	explorer.exe	93
PID 4172 wrote to memory of 1140	4172	explorer.exe	93
PID 4172 wrote to memory of 3380	4172	explorer.exe	94
PID 4172 wrote to memory of 3380	4172	explorer.exe	94
PID 4172 wrote to memory of 3380	4172	explorer.exe	94
PID 4172 wrote to memory of 4516	4172	explorer.exe	95
PID 4172 wrote to memory of 4516	4172	explorer.exe	95
PID 4172 wrote to memory of 4516	4172	explorer.exe	95
PID 4172 wrote to memory of 4532	4172	explorer.exe	96
PID 4172 wrote to memory of 4532	4172	explorer.exe	96
PID 4172 wrote to memory of 4532	4172	explorer.exe	96
PID 4172 wrote to memory of 4568	4172	explorer.exe	97
PID 4172 wrote to memory of 4568	4172	explorer.exe	97
PID 4172 wrote to memory of 4568	4172	explorer.exe	97
PID 4172 wrote to memory of 2368	4172	explorer.exe	98
PID 4172 wrote to memory of 2368	4172	explorer.exe	98
PID 4172 wrote to memory of 2368	4172	explorer.exe	98
PID 4172 wrote to memory of 876	4172	explorer.exe	99
PID 4172 wrote to memory of 876	4172	explorer.exe	99
PID 4172 wrote to memory of 876	4172	explorer.exe	99
PID 4172 wrote to memory of 1824	4172	explorer.exe	100
PID 4172 wrote to memory of 1824	4172	explorer.exe	100
PID 4172 wrote to memory of 1824	4172	explorer.exe	100
PID 4172 wrote to memory of 3912	4172	explorer.exe	101
PID 4172 wrote to memory of 3912	4172	explorer.exe	101
PID 4172 wrote to memory of 3912	4172	explorer.exe	101
PID 4172 wrote to memory of 3992	4172	explorer.exe	102
PID 4172 wrote to memory of 3992	4172	explorer.exe	102
PID 4172 wrote to memory of 3992	4172	explorer.exe	102
PID 4172 wrote to memory of 2124	4172	explorer.exe	103
PID 4172 wrote to memory of 2124	4172	explorer.exe	103
PID 4172 wrote to memory of 2124	4172	explorer.exe	103
PID 4172 wrote to memory of 4028	4172	explorer.exe	104
PID 4172 wrote to memory of 4028	4172	explorer.exe	104
PID 4172 wrote to memory of 4028	4172	explorer.exe	104
PID 4172 wrote to memory of 3060	4172	explorer.exe	105
PID 4172 wrote to memory of 3060	4172	explorer.exe	105
PID 4172 wrote to memory of 3060	4172	explorer.exe	105
PID 4172 wrote to memory of 1864	4172	explorer.exe	106
PID 4172 wrote to memory of 1864	4172	explorer.exe	106
PID 4172 wrote to memory of 1864	4172	explorer.exe	106
PID 4172 wrote to memory of 4980	4172	explorer.exe	107
PID 4172 wrote to memory of 4980	4172	explorer.exe	107
PID 4172 wrote to memory of 4980	4172	explorer.exe	107
PID 4172 wrote to memory of 3840	4172	explorer.exe	108
PID 4172 wrote to memory of 3840	4172	explorer.exe	108
PID 4172 wrote to memory of 3840	4172	explorer.exe	108
PID 4172 wrote to memory of 3888	4172	explorer.exe	109

C:\Users\Admin\AppData\Local\Temp\a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2728
- C:\Users\Admin\AppData\Local\Temp\a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a3df5b8dd6f38344e4d85c53e932b708_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4816
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4172
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1140
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:540
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3740
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4516
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4800
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1704
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4532
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2368
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1224
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4976
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:876
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1824
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4212
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2896
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3912
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3272
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:984
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2124
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2912
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4588
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3060
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1864
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3108
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3416
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4980
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3872
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2900
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3888
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4508
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2544
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:664
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4260
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1020
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2156
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2336
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3996
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4188
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3168
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4452
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1392
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3612
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1800
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4152
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2524
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2480
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1320
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3592
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2612
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4760
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:800
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5024
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4464
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3796
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3100
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1248
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1280
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4944
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4428
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3728
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1116
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3688
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:976
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:960
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1172
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3736
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2348
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 5c8e31d0b890b7eba57918beb867b95c767ce30018c343408a35b7852ae02728
MD5 a38de84b7f376010ed3a2880caf7a50c
SHA1 401f2e167d3746cc3def10d4f44cd3cbdbb51163
SHA512 ed18d8272f242e47e53ff75f8e8c5aeac9b83a23d4876f6fa34ed04df1eebdb858ad25f6343655d71779747a1456c17da74d9b30bc75c3f9c14919c3e71548bb
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZk:0UzeyQMS4DqodCnoe+iitjWwwg
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 8682e18a05917fb17d5d63e133d6f90626c5ca6c80a900f5f4d8119762d32cfa
MD5 3f3f3c709f4892a4711935327c989de2
SHA1 59dcbd662332d2a755b0b40f30335c032d69cb96
SHA512 7142b808e38498f12bf806028a1a04e9960846561190cddb19de0d5cef135cec2575526749c8e2f8c0944d56f53f362f8bc94062079f63185513a9b1ff7de240
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZF:0UzeyQMS4DqodCnoe+iitjWwwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-1749-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/408-4409-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/408-4413-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/540-1664-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/540-1508-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/800-3869-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/800-4002-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/876-956-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1028-3757-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1064-1681-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1092-1672-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1128-3879-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1140-1509-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1140-599-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1172-5090-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1172-4997-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1224-1975-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1224-1811-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1248-4262-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1248-4383-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1476-4794-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1544-2505-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1580-3267-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1800-3381-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1800-3490-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1824-1089-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1864-1505-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1948-3748-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1948-3745-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2028-5014-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2028-5017-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2124-1284-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2156-3010-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2156-3014-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2160-4616-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2196-1583-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2196-1585-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/2292-1908-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2292-1904-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2348-5111-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2368-955-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2428-4113-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2480-3718-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2480-3585-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2540-2713-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2612-3735-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2612-3849-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2672-1750-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2672-1755-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2772-23-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/2772-21-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2772-0-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/2772-27-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2912-2352-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2912-2476-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3060-1393-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3108-2494-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3108-2614-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3272-2195-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3272-2333-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3380-1584-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3380-726-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3504-68-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3504-63-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3688-4783-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3688-4881-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3840-1581-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3872-2747-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3872-2631-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3888-1582-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3912-1090-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3924-3593-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3924-3596-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3948-5007-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3992-1283-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3996-3063-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4028-1392-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4172-67-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4172-598-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4212-1993-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4212-2116-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4252-5120-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4252-5123-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4260-3032-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4260-2897-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4288-3447-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4408-2779-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4428-4691-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4428-4560-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4452-3309-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4452-3188-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4464-4023-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4508-2771-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4508-2870-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4516-1670-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4516-727-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4528-2989-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4532-853-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4532-1682-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4540-2053-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4568-1751-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4568-854-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4800-1792-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4800-1673-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4816-26-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4816-57-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4816-24-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4844-4171-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4924-4033-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4940-4774-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4944-4541-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4944-4401-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4972-2359-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4972-2363-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4980-1507-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4992-4636-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5056-4904-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5056-4868-0x0000000000400000-0x000000000043E000-memory.dmp

Download