Analysis
-
max time kernel
138s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 18:45
Behavioral task
behavioral1
Sample
b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
b4a556ab0e95ad48c81ad37c96ecbd0e
-
SHA1
45067217c2eef2426e796e9c1a2d2ef5ea6b15cb
-
SHA256
cd244999f3e0ce46ab40da3b70de9cbf43a934dcd123b19bd2c612691db2e237
-
SHA512
acc25ba6a4492e0aa0739c872bd98f5c0c2a4b228e75e3aaa56098c6b0c9b454c98fed8f7b4377cd7d527664b547b29b30f90eb3c1a2d352da7571e59bf47390
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZE:0UzeyQMS4DqodCnoe+iitjWwwI
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 4968 explorer.exe 1540 explorer.exe 372 spoolsv.exe 4892 spoolsv.exe 3812 spoolsv.exe 4540 spoolsv.exe 740 spoolsv.exe 3296 spoolsv.exe 3032 spoolsv.exe 1484 spoolsv.exe 4252 spoolsv.exe 184 spoolsv.exe 4224 spoolsv.exe 1648 spoolsv.exe 4256 spoolsv.exe 1556 spoolsv.exe 2896 spoolsv.exe 3468 spoolsv.exe 4132 spoolsv.exe 5100 spoolsv.exe 1800 spoolsv.exe 4080 spoolsv.exe 4616 spoolsv.exe 2848 spoolsv.exe 3448 spoolsv.exe 3916 spoolsv.exe 4016 spoolsv.exe 2356 spoolsv.exe 3088 spoolsv.exe 3852 spoolsv.exe 2732 spoolsv.exe 3664 spoolsv.exe 388 spoolsv.exe 3584 spoolsv.exe 1992 spoolsv.exe 1368 spoolsv.exe 2332 spoolsv.exe 656 explorer.exe 2636 spoolsv.exe 100 spoolsv.exe 4996 spoolsv.exe 3084 spoolsv.exe 1380 spoolsv.exe 2496 spoolsv.exe 1272 spoolsv.exe 1880 spoolsv.exe 3940 spoolsv.exe 3180 spoolsv.exe 4640 explorer.exe 4760 spoolsv.exe 2860 spoolsv.exe 5028 spoolsv.exe 2620 spoolsv.exe 2348 spoolsv.exe 328 spoolsv.exe 1320 spoolsv.exe 2964 spoolsv.exe 2376 explorer.exe 4636 spoolsv.exe 1652 spoolsv.exe 2412 spoolsv.exe 1968 spoolsv.exe 3080 spoolsv.exe 2452 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 50 IoCs
description pid Process procid_target PID 1736 set thread context of 3684 1736 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 86 PID 4968 set thread context of 1540 4968 explorer.exe 91 PID 372 set thread context of 2332 372 spoolsv.exe 126 PID 4892 set thread context of 2636 4892 spoolsv.exe 128 PID 3812 set thread context of 100 3812 spoolsv.exe 129 PID 4540 set thread context of 3084 4540 spoolsv.exe 131 PID 740 set thread context of 1380 740 spoolsv.exe 132 PID 3296 set thread context of 2496 3296 spoolsv.exe 133 PID 3032 set thread context of 1272 3032 spoolsv.exe 134 PID 1484 set thread context of 1880 1484 spoolsv.exe 135 PID 4252 set thread context of 3940 4252 spoolsv.exe 136 PID 184 set thread context of 3180 184 spoolsv.exe 137 PID 4224 set thread context of 2860 4224 spoolsv.exe 140 PID 1648 set thread context of 5028 1648 spoolsv.exe 141 PID 4256 set thread context of 2620 4256 spoolsv.exe 142 PID 1556 set thread context of 2348 1556 spoolsv.exe 143 PID 2896 set thread context of 328 2896 spoolsv.exe 144 PID 3468 set thread context of 1320 3468 spoolsv.exe 145 PID 4132 set thread context of 2964 4132 spoolsv.exe 146 PID 5100 set thread context of 1652 5100 spoolsv.exe 149 PID 1800 set thread context of 2412 1800 spoolsv.exe 150 PID 4080 set thread context of 1968 4080 spoolsv.exe 151 PID 4616 set thread context of 3080 4616 spoolsv.exe 152 PID 2848 set thread context of 2452 2848 spoolsv.exe 153 PID 3448 set thread context of 4408 3448 spoolsv.exe 156 PID 3916 set thread context of 2716 3916 spoolsv.exe 157 PID 4016 set thread context of 2560 4016 spoolsv.exe 158 PID 2356 set thread context of 3412 2356 spoolsv.exe 159 PID 3088 set thread context of 3040 3088 spoolsv.exe 162 PID 3852 set thread context of 3844 3852 spoolsv.exe 163 PID 2732 set thread context of 3752 2732 spoolsv.exe 164 PID 3664 set thread context of 4908 3664 spoolsv.exe 165 PID 388 set thread context of 1668 388 spoolsv.exe 167 PID 3584 set thread context of 3020 3584 spoolsv.exe 169 PID 1992 set thread context of 3532 1992 spoolsv.exe 171 PID 1368 set thread context of 2300 1368 spoolsv.exe 174 PID 656 set thread context of 3964 656 explorer.exe 180 PID 4996 set thread context of 2720 4996 spoolsv.exe 182 PID 4640 set thread context of 3248 4640 explorer.exe 188 PID 4760 set thread context of 2692 4760 spoolsv.exe 190 PID 2376 set thread context of 3184 2376 explorer.exe 195 PID 4636 set thread context of 2264 4636 spoolsv.exe 196 PID 3560 set thread context of 1612 3560 explorer.exe 200 PID 2260 set thread context of 4136 2260 spoolsv.exe 202 PID 536 set thread context of 3176 536 spoolsv.exe 206 PID 1260 set thread context of 2548 1260 explorer.exe 208 PID 4720 set thread context of 3200 4720 spoolsv.exe 210 PID 3492 set thread context of 5056 3492 explorer.exe 212 PID 612 set thread context of 2892 612 spoolsv.exe 214 PID 1596 set thread context of 3936 1596 spoolsv.exe 215 -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\explorer.exe b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3684 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 3684 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1540 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3684 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 3684 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 1540 explorer.exe 2332 spoolsv.exe 2332 spoolsv.exe 2636 spoolsv.exe 2636 spoolsv.exe 100 spoolsv.exe 100 spoolsv.exe 3084 spoolsv.exe 3084 spoolsv.exe 1380 spoolsv.exe 1380 spoolsv.exe 2496 spoolsv.exe 2496 spoolsv.exe 1272 spoolsv.exe 1272 spoolsv.exe 1880 spoolsv.exe 1880 spoolsv.exe 3940 spoolsv.exe 3940 spoolsv.exe 3180 spoolsv.exe 3180 spoolsv.exe 2860 spoolsv.exe 2860 spoolsv.exe 5028 spoolsv.exe 5028 spoolsv.exe 2620 spoolsv.exe 2620 spoolsv.exe 2348 spoolsv.exe 2348 spoolsv.exe 328 spoolsv.exe 328 spoolsv.exe 1320 spoolsv.exe 1320 spoolsv.exe 2964 spoolsv.exe 2964 spoolsv.exe 1652 spoolsv.exe 1652 spoolsv.exe 2412 spoolsv.exe 2412 spoolsv.exe 1968 spoolsv.exe 1968 spoolsv.exe 3080 spoolsv.exe 3080 spoolsv.exe 2452 spoolsv.exe 2452 spoolsv.exe 4408 spoolsv.exe 4408 spoolsv.exe 2716 spoolsv.exe 2716 spoolsv.exe 2560 spoolsv.exe 2560 spoolsv.exe 3412 spoolsv.exe 3412 spoolsv.exe 3040 spoolsv.exe 3040 spoolsv.exe 3844 spoolsv.exe 3844 spoolsv.exe 3752 spoolsv.exe 3752 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1736 wrote to memory of 4496 1736 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 81 PID 1736 wrote to memory of 4496 1736 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 81 PID 1736 wrote to memory of 3684 1736 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 86 PID 1736 wrote to memory of 3684 1736 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 86 PID 1736 wrote to memory of 3684 1736 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 86 PID 1736 wrote to memory of 3684 1736 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 86 PID 1736 wrote to memory of 3684 1736 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 86 PID 3684 wrote to memory of 4968 3684 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 87 PID 3684 wrote to memory of 4968 3684 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 87 PID 3684 wrote to memory of 4968 3684 b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe 87 PID 4968 wrote to memory of 1540 4968 explorer.exe 91 PID 4968 wrote to memory of 1540 4968 explorer.exe 91 PID 4968 wrote to memory of 1540 4968 explorer.exe 91 PID 4968 wrote to memory of 1540 4968 explorer.exe 91 PID 4968 wrote to memory of 1540 4968 explorer.exe 91 PID 1540 wrote to memory of 372 1540 explorer.exe 92 PID 1540 wrote to memory of 372 1540 explorer.exe 92 PID 1540 wrote to memory of 372 1540 explorer.exe 92 PID 1540 wrote to memory of 4892 1540 explorer.exe 93 PID 1540 wrote to memory of 4892 1540 explorer.exe 93 PID 1540 wrote to memory of 4892 1540 explorer.exe 93 PID 1540 wrote to memory of 3812 1540 explorer.exe 94 PID 1540 wrote to memory of 3812 1540 explorer.exe 94 PID 1540 wrote to memory of 3812 1540 explorer.exe 94 PID 1540 wrote to memory of 4540 1540 explorer.exe 95 PID 1540 wrote to memory of 4540 1540 explorer.exe 95 PID 1540 wrote to memory of 4540 1540 explorer.exe 95 PID 1540 wrote to memory of 740 1540 explorer.exe 96 PID 1540 wrote to memory of 740 1540 explorer.exe 96 PID 1540 wrote to memory of 740 1540 explorer.exe 96 PID 1540 wrote to memory of 3296 1540 explorer.exe 97 PID 1540 wrote to memory of 3296 1540 explorer.exe 97 PID 1540 wrote to memory of 3296 1540 explorer.exe 97 PID 1540 wrote to memory of 3032 1540 explorer.exe 98 PID 1540 wrote to memory of 3032 1540 explorer.exe 98 PID 1540 wrote to memory of 3032 1540 explorer.exe 98 PID 1540 wrote to memory of 1484 1540 explorer.exe 99 PID 1540 wrote to memory of 1484 1540 explorer.exe 99 PID 1540 wrote to memory of 1484 1540 explorer.exe 99 PID 1540 wrote to memory of 4252 1540 explorer.exe 100 PID 1540 wrote to memory of 4252 1540 explorer.exe 100 PID 1540 wrote to memory of 4252 1540 explorer.exe 100 PID 1540 wrote to memory of 184 1540 explorer.exe 101 PID 1540 wrote to memory of 184 1540 explorer.exe 101 PID 1540 wrote to memory of 184 1540 explorer.exe 101 PID 1540 wrote to memory of 4224 1540 explorer.exe 102 PID 1540 wrote to memory of 4224 1540 explorer.exe 102 PID 1540 wrote to memory of 4224 1540 explorer.exe 102 PID 1540 wrote to memory of 1648 1540 explorer.exe 103 PID 1540 wrote to memory of 1648 1540 explorer.exe 103 PID 1540 wrote to memory of 1648 1540 explorer.exe 103 PID 1540 wrote to memory of 4256 1540 explorer.exe 104 PID 1540 wrote to memory of 4256 1540 explorer.exe 104 PID 1540 wrote to memory of 4256 1540 explorer.exe 104 PID 1540 wrote to memory of 1556 1540 explorer.exe 105 PID 1540 wrote to memory of 1556 1540 explorer.exe 105 PID 1540 wrote to memory of 1556 1540 explorer.exe 105 PID 1540 wrote to memory of 2896 1540 explorer.exe 106 PID 1540 wrote to memory of 2896 1540 explorer.exe 106 PID 1540 wrote to memory of 2896 1540 explorer.exe 106 PID 1540 wrote to memory of 3468 1540 explorer.exe 107 PID 1540 wrote to memory of 3468 1540 explorer.exe 107 PID 1540 wrote to memory of 3468 1540 explorer.exe 107 PID 1540 wrote to memory of 4132 1540 explorer.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:4496
-
-
C:\Users\Admin\AppData\Local\Temp\b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4a556ab0e95ad48c81ad37c96ecbd0e_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:372 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2332 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:656 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3964
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4892 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2636
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3812 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:100
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4540 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3084
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:740 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1380
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3296 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2496
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3032 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1272
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1484 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1880
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4252 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3940
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:184 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3180 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4640 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3248
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4224 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2860
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1648 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5028
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4256 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2620
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1556 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2348
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2896 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:328
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3468 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1320
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4132 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2964 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2376 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3184
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5100 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1652
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1800 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2412
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4080 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1968
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4616 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3080
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2848 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2452 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3560 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:1612
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3448 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:4408
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3916 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2716
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4016 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:2560
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2356 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3412 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1260 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:2548
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3088 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3040
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3852 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3844
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2732 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:3752
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3664 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4908
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:388 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1668
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3492 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:5056
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3584 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3020
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1992 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3532
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1368 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2300
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:3676 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:4684
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4996 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2720
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4436 -
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵PID:3744
-
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4760 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2692
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:436
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4636 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2264
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:4548
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2260 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4136
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:1072
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:536 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3176
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
PID:4964
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4720 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3200
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:5004
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
PID:612 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2892
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1596 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3936
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1616
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:3000
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1336
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3688
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4924
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4392 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4712
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4288 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4680
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:368
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1416 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1008
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3256 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4312
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:2544
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:1224
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:1544
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2296 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:4672
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4396 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:2956
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵PID:3976
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3612 -
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵PID:188
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3288
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:3836
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3476
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2064
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:1904
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:3624
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4272
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:2712
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4068
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
PID:4868
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4740
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1068
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1756
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4356
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:1056
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵PID:4116
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3156
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
Filesize
2.2MB
MD589fa0cc7385ddd4c356fa9a6270f0a9d
SHA117f511bf9e013e43b01fa3c1f81d9cff24863363
SHA25651dc6d8556eb4020b4772932b3d3f20ae0a268f39b611e36f4b05751ee137acd
SHA51237b2088ce23588e7a3cb97b2f86bf33d7b00c5eac552abe1d8dd97894f60534b6a558b92d101baea760a923c34878e936afc4f7bf6e2c2585842dc6fde3dc45e
-
Filesize
2.2MB
MD50b26009bc2b6e512248c335241c0c9cc
SHA1f8b186310492be5887576cb8af600fde95bcaa7b
SHA2564075a75cd3fdac5e1873c3db6b435e028f22afeb220d0acb70b4571f3d6eaf55
SHA5127d80399fd2fdc55eb8b41775f043df393db81421790afb4ecaa6fff2e3d6a2881e44159d3d35ca2b9ab6a54b80be7875c87c57a676ea0c8edd157b2e30d78cdf