pony | 4ab0273e4ad966451743b78fa9832fb5a2ac138f44cdd586bf42b9b0bf39a5ba

Analysis

max time kernel
114s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe
Size 2.2MB
Sample240615-eq2fxsydmc
SHA256 4ab0273e4ad966451743b78fa9832fb5a2ac138f44cdd586bf42b9b0bf39a5ba
MD5 acd5ae42c756812aaa856f177da03fa9
SHA1 6454354f6b2cfeb954f8edc6e76d29441ee675cb
SHA512 0143f4dcacf81177ad5bb5671e59dbfe265765c6c522c55a777d44392ee38b3b5bd5a71744af3bfcf7070831bd5b7cf7f23f2dea8463c8d95e54e0fb09d3914d
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZd:0UzeyQMS4DqodCnoe+iitjWww5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe	acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe	acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
3588	explorer.exe
2732	explorer.exe
4488	spoolsv.exe
2956	spoolsv.exe
4848	spoolsv.exe
2444	spoolsv.exe
4428	spoolsv.exe
4348	spoolsv.exe
3360	spoolsv.exe
4924	spoolsv.exe
1712	spoolsv.exe
2496	spoolsv.exe
1640	spoolsv.exe
1628	spoolsv.exe
2580	spoolsv.exe
392	spoolsv.exe
3944	spoolsv.exe
4252	spoolsv.exe
4664	spoolsv.exe
1484	spoolsv.exe
1708	spoolsv.exe
2392	spoolsv.exe
5032	spoolsv.exe
3316	spoolsv.exe
560	spoolsv.exe
1016	spoolsv.exe
1952	spoolsv.exe
964	spoolsv.exe
3020	explorer.exe
1980	spoolsv.exe
4032	spoolsv.exe
2644	spoolsv.exe
2296	explorer.exe
4492	spoolsv.exe
1288	spoolsv.exe
3844	spoolsv.exe
864	spoolsv.exe
1184	explorer.exe
1748	spoolsv.exe
2672	spoolsv.exe
2944	spoolsv.exe
4244	spoolsv.exe
2640	explorer.exe
4692	spoolsv.exe
4688	spoolsv.exe
1188	spoolsv.exe
1284	spoolsv.exe
4180	explorer.exe
3380	spoolsv.exe
2804	spoolsv.exe
3772	spoolsv.exe
4892	explorer.exe
4836	spoolsv.exe
4648	spoolsv.exe
3792	spoolsv.exe
4220	explorer.exe
672	spoolsv.exe
1448	spoolsv.exe
3572	spoolsv.exe
516	explorer.exe
1804	spoolsv.exe
3608	spoolsv.exe
4952	explorer.exe
2608	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 26 IoCs

description	pid	Process	procid_target
PID 220 set thread context of 3180	220	acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe	87
PID 3588 set thread context of 2732	3588	explorer.exe	92
PID 4488 set thread context of 964	4488	spoolsv.exe	118
PID 2956 set thread context of 4032	2956	spoolsv.exe	121
PID 4848 set thread context of 2644	4848	spoolsv.exe	122
PID 2444 set thread context of 4492	2444	spoolsv.exe	124
PID 4428 set thread context of 3844	4428	spoolsv.exe	126
PID 4348 set thread context of 864	4348	spoolsv.exe	127
PID 3360 set thread context of 1748	3360	spoolsv.exe	129
PID 4924 set thread context of 2944	4924	spoolsv.exe	131
PID 1712 set thread context of 4244	1712	spoolsv.exe	132
PID 2496 set thread context of 4688	2496	spoolsv.exe	135
PID 1640 set thread context of 1284	1640	spoolsv.exe	137
PID 1628 set thread context of 3380	1628	spoolsv.exe	139
PID 2580 set thread context of 3772	2580	spoolsv.exe	141
PID 392 set thread context of 4836	392	spoolsv.exe	143
PID 3944 set thread context of 3792	3944	spoolsv.exe	145
PID 4252 set thread context of 1448	4252	spoolsv.exe	148
PID 4664 set thread context of 3572	4664	spoolsv.exe	149
PID 1484 set thread context of 3608	1484	spoolsv.exe	152
PID 1708 set thread context of 4748	1708	spoolsv.exe	155
PID 2392 set thread context of 4004	2392	spoolsv.exe	156
PID 5032 set thread context of 3468	5032	spoolsv.exe	157
PID 3316 set thread context of 2752	3316	spoolsv.exe	160
PID 560 set thread context of 4460	560	spoolsv.exe	161
PID 1016 set thread context of 2024	1016	spoolsv.exe	164

Drops file in Windows directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3180	acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe
3180	acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe

Suspicious use of SetWindowsHookEx 54 IoCs

pid	Process
3180	acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe
3180	acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
964	spoolsv.exe
964	spoolsv.exe
4032	spoolsv.exe
4032	spoolsv.exe
2644	spoolsv.exe
2644	spoolsv.exe
4492	spoolsv.exe
4492	spoolsv.exe
3844	spoolsv.exe
3844	spoolsv.exe
864	spoolsv.exe
864	spoolsv.exe
1748	spoolsv.exe
1748	spoolsv.exe
2944	spoolsv.exe
2944	spoolsv.exe
4244	spoolsv.exe
4244	spoolsv.exe
4688	spoolsv.exe
4688	spoolsv.exe
1284	spoolsv.exe
1284	spoolsv.exe
3380	spoolsv.exe
3380	spoolsv.exe
3772	spoolsv.exe
3772	spoolsv.exe
4836	spoolsv.exe
4836	spoolsv.exe
3792	spoolsv.exe
3792	spoolsv.exe
1448	spoolsv.exe
1448	spoolsv.exe
3572	spoolsv.exe
3572	spoolsv.exe
3608	spoolsv.exe
3608	spoolsv.exe
4748	spoolsv.exe
4748	spoolsv.exe
4004	spoolsv.exe
4004	spoolsv.exe
3468	spoolsv.exe
3468	spoolsv.exe
2752	spoolsv.exe
2752	spoolsv.exe
4460	spoolsv.exe
4460	spoolsv.exe
2024	spoolsv.exe
2024	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 1852	220	acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe	82
PID 220 wrote to memory of 1852	220	acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe	82
PID 220 wrote to memory of 3180	220	acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe	87
PID 220 wrote to memory of 3180	220	acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe	87
PID 220 wrote to memory of 3180	220	acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe	87
PID 220 wrote to memory of 3180	220	acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe	87
PID 220 wrote to memory of 3180	220	acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe	87
PID 3180 wrote to memory of 3588	3180	acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe	88
PID 3180 wrote to memory of 3588	3180	acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe	88
PID 3180 wrote to memory of 3588	3180	acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe	88
PID 3588 wrote to memory of 2732	3588	explorer.exe	92
PID 3588 wrote to memory of 2732	3588	explorer.exe	92
PID 3588 wrote to memory of 2732	3588	explorer.exe	92
PID 3588 wrote to memory of 2732	3588	explorer.exe	92
PID 3588 wrote to memory of 2732	3588	explorer.exe	92
PID 2732 wrote to memory of 4488	2732	explorer.exe	93
PID 2732 wrote to memory of 4488	2732	explorer.exe	93
PID 2732 wrote to memory of 4488	2732	explorer.exe	93
PID 2732 wrote to memory of 2956	2732	explorer.exe	94
PID 2732 wrote to memory of 2956	2732	explorer.exe	94
PID 2732 wrote to memory of 2956	2732	explorer.exe	94
PID 2732 wrote to memory of 4848	2732	explorer.exe	95
PID 2732 wrote to memory of 4848	2732	explorer.exe	95
PID 2732 wrote to memory of 4848	2732	explorer.exe	95
PID 2732 wrote to memory of 2444	2732	explorer.exe	96
PID 2732 wrote to memory of 2444	2732	explorer.exe	96
PID 2732 wrote to memory of 2444	2732	explorer.exe	96
PID 2732 wrote to memory of 4428	2732	explorer.exe	97
PID 2732 wrote to memory of 4428	2732	explorer.exe	97
PID 2732 wrote to memory of 4428	2732	explorer.exe	97
PID 2732 wrote to memory of 4348	2732	explorer.exe	98
PID 2732 wrote to memory of 4348	2732	explorer.exe	98
PID 2732 wrote to memory of 4348	2732	explorer.exe	98
PID 2732 wrote to memory of 3360	2732	explorer.exe	99
PID 2732 wrote to memory of 3360	2732	explorer.exe	99
PID 2732 wrote to memory of 3360	2732	explorer.exe	99
PID 2732 wrote to memory of 4924	2732	explorer.exe	100
PID 2732 wrote to memory of 4924	2732	explorer.exe	100
PID 2732 wrote to memory of 4924	2732	explorer.exe	100
PID 2732 wrote to memory of 1712	2732	explorer.exe	101
PID 2732 wrote to memory of 1712	2732	explorer.exe	101
PID 2732 wrote to memory of 1712	2732	explorer.exe	101
PID 2732 wrote to memory of 2496	2732	explorer.exe	102
PID 2732 wrote to memory of 2496	2732	explorer.exe	102
PID 2732 wrote to memory of 2496	2732	explorer.exe	102
PID 2732 wrote to memory of 1640	2732	explorer.exe	103
PID 2732 wrote to memory of 1640	2732	explorer.exe	103
PID 2732 wrote to memory of 1640	2732	explorer.exe	103
PID 2732 wrote to memory of 1628	2732	explorer.exe	104
PID 2732 wrote to memory of 1628	2732	explorer.exe	104
PID 2732 wrote to memory of 1628	2732	explorer.exe	104
PID 2732 wrote to memory of 2580	2732	explorer.exe	105
PID 2732 wrote to memory of 2580	2732	explorer.exe	105
PID 2732 wrote to memory of 2580	2732	explorer.exe	105
PID 2732 wrote to memory of 392	2732	explorer.exe	106
PID 2732 wrote to memory of 392	2732	explorer.exe	106
PID 2732 wrote to memory of 392	2732	explorer.exe	106
PID 2732 wrote to memory of 3944	2732	explorer.exe	107
PID 2732 wrote to memory of 3944	2732	explorer.exe	107
PID 2732 wrote to memory of 3944	2732	explorer.exe	107
PID 2732 wrote to memory of 4252	2732	explorer.exe	108
PID 2732 wrote to memory of 4252	2732	explorer.exe	108
PID 2732 wrote to memory of 4252	2732	explorer.exe	108
PID 2732 wrote to memory of 4664	2732	explorer.exe	109

C:\Users\Admin\AppData\Local\Temp\acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1852
- C:\Users\Admin\AppData\Local\Temp\acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\acd5ae42c756812aaa856f177da03fa9_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3180
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4488
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:964
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3020
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4848
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2644
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2296
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4428
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4348
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:864
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1184
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4924
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1712
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4244
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2640
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1284
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4180
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2580
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3772
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4892
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3792
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4220
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4252
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4664
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3572
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:516
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3608
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4952
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5032
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3468
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4544
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4460
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1792
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3544
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1416
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1980
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1828
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1888
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1288
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3828
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4496
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2672
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2588
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1188
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4944
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1880
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4648
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:672
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3284
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3440
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2536
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1108
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4372
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2988
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2696
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:180
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4916
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1092
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2144
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 6070a0164f054334e6051f715ab3124f03cba02affc316af6fc3d1be782c94c7
MD5 1f458ecd5548c1714ca600b499249043
SHA1 099ac14b6d0a3b5f0277ad31531689a036c423e4
SHA512 728a12e5b5c5b4e817fe394630603e83a8ae0e5539f537a1ea0084a993ec8e7fcbb2049493e877770ce03335d8a2abf48127a91dfb3df44f7dabc95c5288336d
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZT:0UzeyQMS4DqodCnoe+iitjWwwX
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 4564c8d7b2c6d7a744212aa13bd25b9a3f98e12c312afa04d9a4d32c32e8ec6c
MD5 9d5779932c601ffd924c97d07dbfcc7c
SHA1 02c5d987416b1766cab269f58c3874685e5f093e
SHA512 7d00ae62d44ce041546408ee97e3699eaa61be793cb3430ea3d2a4abeff2cdc5c7738abc37423cd9c9eabc84509db5ea663597df04b8648f126c52bd6ea29205
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZe:0UzeyQMS4DqodCnoe+iitjWwwi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/180-5104-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/212-3676-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/212-3680-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/220-28-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/220-0-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/220-23-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/220-21-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/388-5056-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/392-1349-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/556-4697-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/628-4848-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/864-2038-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/864-1878-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/964-1561-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/964-1699-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/964-1701-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1092-5181-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1108-4687-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1284-2378-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1284-2280-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1332-4707-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1448-2713-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1484-1708-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1488-4456-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1628-1347-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1640-1239-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1708-1718-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1712-1116-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1748-1889-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1748-1887-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1828-3667-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1880-4269-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1880-4336-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2024-3330-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2244-4381-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2244-4378-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2444-1716-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2444-869-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2496-1238-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2536-4655-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2580-1348-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2588-3898-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2644-1860-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2644-1709-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2680-3995-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2732-85-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2732-564-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2752-3175-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2904-4057-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2944-1990-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2956-688-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2956-1678-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2988-4951-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2988-4839-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3180-26-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3180-27-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3180-74-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3284-4368-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3360-1002-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3380-2298-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3384-3986-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3440-4441-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3468-3109-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3544-3574-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3544-3461-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3572-2929-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3572-2796-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3588-86-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3588-80-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3608-3092-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3608-2950-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3772-2472-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3772-2617-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3792-2779-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3828-3879-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3828-3753-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3844-1795-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3884-3817-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3944-1558-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4004-3041-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4004-3043-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4032-1675-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4244-2192-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4244-2057-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4252-1559-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4300-5307-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4348-1001-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4392-3471-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4428-1000-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4460-3270-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4460-3380-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4488-565-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4488-1562-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4492-1719-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4584-4678-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4584-4681-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4664-1677-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4748-3032-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4748-3029-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4752-4279-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4836-2484-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4836-2481-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4848-1710-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4848-868-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4924-1115-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4944-4243-0x0000000000400000-0x000000000043E000-memory.dmp

Download