Overview

overview

10

Static

static

10

2c11e1f6b0...3N.exe

windows7-x64

10

2c11e1f6b0...3N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    111s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-12-2024 13:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2c11e1f6b0debc4f22ee6c1d416907c91d2daacfb3543a088d9eba08a3abbb53N.exe

  • Size

    2.2MB

  • MD5

    67f11f21d661e845e696eedfbd044c10

  • SHA1

    8cccaa1737c6bb5c49ca08e8d1a71688a7f05c0b

  • SHA256

    2c11e1f6b0debc4f22ee6c1d416907c91d2daacfb3543a088d9eba08a3abbb53

  • SHA512

    3a6d3d34d3f363511f3faea2317b5af4a0645992244f85a2a817be21b11ddb014f699e57506ec7eb7b8510a0063527dd4efafd9b6d857471f7e741c22e74babe

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ5:0UzeyQMS4DqodCnoe+iitjWwwd

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 28 IoCs
  • Drops file in Windows directory 47 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 58 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c11e1f6b0debc4f22ee6c1d416907c91d2daacfb3543a088d9eba08a3abbb53N.exe
    "C:\Users\Admin\AppData\Local\Temp\2c11e1f6b0debc4f22ee6c1d416907c91d2daacfb3543a088d9eba08a3abbb53N.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3932
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1216
      • C:\Users\Admin\AppData\Local\Temp\2c11e1f6b0debc4f22ee6c1d416907c91d2daacfb3543a088d9eba08a3abbb53N.exe
        "C:\Users\Admin\AppData\Local\Temp\2c11e1f6b0debc4f22ee6c1d416907c91d2daacfb3543a088d9eba08a3abbb53N.exe"
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3608
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3236
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1040
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:216
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:864
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2956
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:1876
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:900
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2304
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4992
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4504
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3504
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1896
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:448
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1164
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2364
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2276
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4464
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2188
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:3172
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:5080
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1320
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2268
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1432
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1864
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1884
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3204
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2648
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4848
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3964
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2560
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4564
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:2084
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:232
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:920
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3228
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4184
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:5044
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4616
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2096
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3800
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3260
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:1600
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2372
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3788
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1560
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2564
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:2848
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3340
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1824
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:5084
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2228
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3924
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:696
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:1548
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1752
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4188
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1388
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2732
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3296
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1428
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • System Location Discovery: System Language Discovery
                    PID:2152
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3596
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3076
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2824
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                    PID:1596
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3740
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                      PID:1000
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                          PID:4108
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:3476
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      PID:1624
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:4736
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:4312
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:4876
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:2148
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:2792
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                        PID:1668
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                          PID:3780
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                            PID:5052
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                              PID:4832
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                                PID:3012
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                  PID:4392
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                          1⤵
                            PID:1136

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Windows\Parameters.ini
                            Filesize

                            74B

                            MD5

                            6687785d6a31cdf9a5f80acb3abc459b

                            SHA1

                            1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                            SHA256

                            3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                            SHA512

                            5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                            Download Submit

                          • C:\Windows\System\explorer.exe
                            Filesize

                            2.2MB

                            MD5

                            da18d93cc599ed88bd609c76f44ab213

                            SHA1

                            28bcb037eb250641ee843f4ee0e5d57a3ab95f65

                            SHA256

                            814c8fde39d737fc2ce5fe9aea20ce3d5958deb5f7b858e5fb2f9a53153f166e

                            SHA512

                            0380408a47f0931805f7d85865300d69afe4b6e4ba10e7e1961e3809a12208c351fbcff8bad69454ca5f83b6f03a2d72e7218710f0bd1d83688d33071e365f38

                            Download Submit

                          • C:\Windows\System\spoolsv.exe
                            Filesize

                            2.2MB

                            MD5

                            b0e568865582f78523ebbc725c76eab2

                            SHA1

                            d62a7becd04c6e71534b051b2bdfff9f6e35f303

                            SHA256

                            41b2a94cb2f38ff602dbbbfb6d0077bf452dba73a22874a0679181dde2ec8501

                            SHA512

                            1982f2e5e7df106b7dbb37e6374b180276bb735c6ab7199fbe1ea51d94bb5357ae2a066fae88ee6e36df62c97e21794036299833339dfabaa0d8fa540f7d8470

                            Download Submit

                          • memory/216-769-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/216-1843-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/232-1496-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/448-1078-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/696-2921-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/696-2787-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/864-1975-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/864-1842-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/900-1855-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/900-885-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/920-2262-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1000-3385-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1040-655-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1040-105-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1164-1886-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1320-2049-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1428-3014-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1432-2059-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1560-1840-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/1596-3072-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1824-2643-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1864-1330-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/1876-3396-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1884-2069-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1896-1875-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/2096-2388-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/2096-2391-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/2188-2038-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/2188-2154-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/2228-2727-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/2268-1263-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/2276-1952-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/2304-1853-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/2364-1119-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/2372-1749-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/2560-1429-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/2564-2753-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/2648-2081-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/2648-2077-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/2732-2880-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/3076-3026-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/3076-3021-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/3204-1331-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/3228-1568-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/3236-106-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/3236-100-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/3260-2465-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/3260-2599-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/3340-1861-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/3504-1007-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/3608-92-0x0000000000440000-0x0000000000509000-memory.dmp

                            Filesize

                            804KB

                            Download

                          • memory/3608-44-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/3608-45-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/3608-94-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/3800-1682-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/3932-41-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/3932-48-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/3932-42-0x0000000002370000-0x0000000002371000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/3932-0-0x0000000002370000-0x0000000002371000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/3964-2088-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/3964-2092-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/4184-2380-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/4184-2448-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/4188-2870-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/4464-1190-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/4504-1862-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/4504-1866-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/4564-2303-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/4564-2253-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/4616-1620-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/4848-1372-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/4992-956-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/4992-1864-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/5080-1231-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/5084-1874-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download