3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe

Analysis

max time kernel
112s
max time network
110s
platform
windows10_x64
resource
win10
submitted
29/06/2020, 07:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe
Size 1.8MB
Sample200629-ldwdf5w7ns
SHA256 3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe
MD5 b36823bbd25c2c1883efd15555af2492
SHA1 3c29947e62002b7316a048abecf4fe54bfcc9394
SHA512 b4f73842f16943312daa928bfd3a32bd96daa186477a8b0ff42006c93f9a0011e304a4394abce8f2bb77df85813cf1270659f8b33370615b70f7b574cbdf1301
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Adds Run entry to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3968	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe
3968	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe

Executes dropped EXE 105 IoCs

pid	Process
3536	explorer.exe
1164	explorer.exe
1524	spoolsv.exe
1832	spoolsv.exe
1968	spoolsv.exe
2136	spoolsv.exe
2184	spoolsv.exe
2680	spoolsv.exe
2860	spoolsv.exe
3688	spoolsv.exe
4020	spoolsv.exe
4004	spoolsv.exe
3244	spoolsv.exe
412	spoolsv.exe
3172	spoolsv.exe
1688	spoolsv.exe
3940	spoolsv.exe
932	spoolsv.exe
936	spoolsv.exe
2380	spoolsv.exe
804	spoolsv.exe
496	spoolsv.exe
3540	spoolsv.exe
1308	spoolsv.exe
1252	spoolsv.exe
1732	spoolsv.exe
2084	spoolsv.exe
2608	spoolsv.exe
3436	spoolsv.exe
3956	spoolsv.exe
4012	spoolsv.exe
784	spoolsv.exe
1108	spoolsv.exe
1032	spoolsv.exe
2700	spoolsv.exe
1184	spoolsv.exe
1668	spoolsv.exe
2364	spoolsv.exe
2324	spoolsv.exe
3328	spoolsv.exe
2428	spoolsv.exe
4028	spoolsv.exe
1948	spoolsv.exe
1116	spoolsv.exe
2576	spoolsv.exe
1964	spoolsv.exe
4128	spoolsv.exe
4160	spoolsv.exe
4192	spoolsv.exe
4224	spoolsv.exe
4256	spoolsv.exe
4288	spoolsv.exe
4320	spoolsv.exe
4352	spoolsv.exe
4384	spoolsv.exe
4416	spoolsv.exe
4448	spoolsv.exe
4480	spoolsv.exe
4512	spoolsv.exe
4544	spoolsv.exe
4576	spoolsv.exe
4608	spoolsv.exe
4644	spoolsv.exe
4676	spoolsv.exe
4708	spoolsv.exe
4740	spoolsv.exe
4772	spoolsv.exe
4804	spoolsv.exe
4836	spoolsv.exe
4868	spoolsv.exe
4900	spoolsv.exe
4932	spoolsv.exe
4964	spoolsv.exe
4996	spoolsv.exe
5028	spoolsv.exe
5060	spoolsv.exe
5092	spoolsv.exe
4008	spoolsv.exe
4188	spoolsv.exe
4252	spoolsv.exe
3536	spoolsv.exe
4380	spoolsv.exe
4444	spoolsv.exe
4332	spoolsv.exe
4604	spoolsv.exe
4652	spoolsv.exe
4732	spoolsv.exe
3544	spoolsv.exe
4864	spoolsv.exe
4940	spoolsv.exe
5020	spoolsv.exe
4688	spoolsv.exe
4168	spoolsv.exe
4360	spoolsv.exe
4536	spoolsv.exe
5104	spoolsv.exe
4796	spoolsv.exe
4956	spoolsv.exe
4088	spoolsv.exe
4568	spoolsv.exe
4928	spoolsv.exe
4492	spoolsv.exe
5124	spoolsv.exe
5156	spoolsv.exe
5188	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 210 IoCs

pid	Process
3968	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe
3968	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe
1164	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1164	explorer.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Modifies the visibility of hidden or system files 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Suspicious use of WriteProcessMemory 340 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 3968	3920	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe	67
PID 3920 wrote to memory of 3968	3920	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe	67
PID 3920 wrote to memory of 3968	3920	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe	67
PID 3920 wrote to memory of 3968	3920	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe	67
PID 3920 wrote to memory of 3968	3920	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe	67
PID 3920 wrote to memory of 3968	3920	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe	67
PID 3920 wrote to memory of 3968	3920	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe	67
PID 3920 wrote to memory of 3968	3920	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe	67
PID 3920 wrote to memory of 3848	3920	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe	68
PID 3920 wrote to memory of 3848	3920	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe	68
PID 3920 wrote to memory of 3848	3920	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe	68
PID 3920 wrote to memory of 3848	3920	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe	68
PID 3920 wrote to memory of 3848	3920	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe	68
PID 3968 wrote to memory of 3536	3968	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe	69
PID 3968 wrote to memory of 3536	3968	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe	69
PID 3968 wrote to memory of 3536	3968	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe	69
PID 3536 wrote to memory of 1164	3536	explorer.exe	76
PID 3536 wrote to memory of 1164	3536	explorer.exe	76
PID 3536 wrote to memory of 1164	3536	explorer.exe	76
PID 3536 wrote to memory of 1164	3536	explorer.exe	76
PID 3536 wrote to memory of 1164	3536	explorer.exe	76
PID 3536 wrote to memory of 1164	3536	explorer.exe	76
PID 3536 wrote to memory of 1164	3536	explorer.exe	76
PID 3536 wrote to memory of 1164	3536	explorer.exe	76
PID 3536 wrote to memory of 3780	3536	explorer.exe	77
PID 3536 wrote to memory of 3780	3536	explorer.exe	77
PID 3536 wrote to memory of 3780	3536	explorer.exe	77
PID 3536 wrote to memory of 3780	3536	explorer.exe	77
PID 3536 wrote to memory of 3780	3536	explorer.exe	77
PID 1164 wrote to memory of 1524	1164	explorer.exe	78
PID 1164 wrote to memory of 1524	1164	explorer.exe	78
PID 1164 wrote to memory of 1524	1164	explorer.exe	78
PID 1164 wrote to memory of 1832	1164	explorer.exe	79
PID 1164 wrote to memory of 1832	1164	explorer.exe	79
PID 1164 wrote to memory of 1832	1164	explorer.exe	79
PID 1164 wrote to memory of 1968	1164	explorer.exe	80
PID 1164 wrote to memory of 1968	1164	explorer.exe	80
PID 1164 wrote to memory of 1968	1164	explorer.exe	80
PID 1164 wrote to memory of 2136	1164	explorer.exe	81
PID 1164 wrote to memory of 2136	1164	explorer.exe	81
PID 1164 wrote to memory of 2136	1164	explorer.exe	81
PID 1164 wrote to memory of 2184	1164	explorer.exe	82
PID 1164 wrote to memory of 2184	1164	explorer.exe	82
PID 1164 wrote to memory of 2184	1164	explorer.exe	82
PID 1164 wrote to memory of 2680	1164	explorer.exe	83
PID 1164 wrote to memory of 2680	1164	explorer.exe	83
PID 1164 wrote to memory of 2680	1164	explorer.exe	83
PID 1164 wrote to memory of 2860	1164	explorer.exe	84
PID 1164 wrote to memory of 2860	1164	explorer.exe	84
PID 1164 wrote to memory of 2860	1164	explorer.exe	84
PID 1164 wrote to memory of 3688	1164	explorer.exe	85
PID 1164 wrote to memory of 3688	1164	explorer.exe	85
PID 1164 wrote to memory of 3688	1164	explorer.exe	85
PID 1164 wrote to memory of 4020	1164	explorer.exe	86
PID 1164 wrote to memory of 4020	1164	explorer.exe	86
PID 1164 wrote to memory of 4020	1164	explorer.exe	86
PID 1164 wrote to memory of 4004	1164	explorer.exe	87
PID 1164 wrote to memory of 4004	1164	explorer.exe	87
PID 1164 wrote to memory of 4004	1164	explorer.exe	87
PID 1164 wrote to memory of 3244	1164	explorer.exe	88
PID 1164 wrote to memory of 3244	1164	explorer.exe	88
PID 1164 wrote to memory of 3244	1164	explorer.exe	88
PID 1164 wrote to memory of 412	1164	explorer.exe	89
PID 1164 wrote to memory of 412	1164	explorer.exe	89
PID 1164 wrote to memory of 412	1164	explorer.exe	89
PID 1164 wrote to memory of 3172	1164	explorer.exe	90
PID 1164 wrote to memory of 3172	1164	explorer.exe	90
PID 1164 wrote to memory of 3172	1164	explorer.exe	90
PID 1164 wrote to memory of 1688	1164	explorer.exe	91
PID 1164 wrote to memory of 1688	1164	explorer.exe	91
PID 1164 wrote to memory of 1688	1164	explorer.exe	91
PID 1164 wrote to memory of 3940	1164	explorer.exe	92
PID 1164 wrote to memory of 3940	1164	explorer.exe	92
PID 1164 wrote to memory of 3940	1164	explorer.exe	92
PID 1164 wrote to memory of 932	1164	explorer.exe	93
PID 1164 wrote to memory of 932	1164	explorer.exe	93
PID 1164 wrote to memory of 932	1164	explorer.exe	93
PID 1164 wrote to memory of 936	1164	explorer.exe	94
PID 1164 wrote to memory of 936	1164	explorer.exe	94
PID 1164 wrote to memory of 936	1164	explorer.exe	94
PID 1164 wrote to memory of 2380	1164	explorer.exe	95
PID 1164 wrote to memory of 2380	1164	explorer.exe	95
PID 1164 wrote to memory of 2380	1164	explorer.exe	95
PID 1164 wrote to memory of 804	1164	explorer.exe	96
PID 1164 wrote to memory of 804	1164	explorer.exe	96
PID 1164 wrote to memory of 804	1164	explorer.exe	96
PID 1164 wrote to memory of 496	1164	explorer.exe	97
PID 1164 wrote to memory of 496	1164	explorer.exe	97
PID 1164 wrote to memory of 496	1164	explorer.exe	97
PID 1164 wrote to memory of 3540	1164	explorer.exe	98
PID 1164 wrote to memory of 3540	1164	explorer.exe	98
PID 1164 wrote to memory of 3540	1164	explorer.exe	98
PID 1164 wrote to memory of 1308	1164	explorer.exe	99
PID 1164 wrote to memory of 1308	1164	explorer.exe	99
PID 1164 wrote to memory of 1308	1164	explorer.exe	99
PID 1164 wrote to memory of 1252	1164	explorer.exe	100
PID 1164 wrote to memory of 1252	1164	explorer.exe	100
PID 1164 wrote to memory of 1252	1164	explorer.exe	100
PID 1164 wrote to memory of 1732	1164	explorer.exe	101
PID 1164 wrote to memory of 1732	1164	explorer.exe	101
PID 1164 wrote to memory of 1732	1164	explorer.exe	101
PID 1164 wrote to memory of 2084	1164	explorer.exe	102
PID 1164 wrote to memory of 2084	1164	explorer.exe	102
PID 1164 wrote to memory of 2084	1164	explorer.exe	102
PID 1164 wrote to memory of 2608	1164	explorer.exe	103
PID 1164 wrote to memory of 2608	1164	explorer.exe	103
PID 1164 wrote to memory of 2608	1164	explorer.exe	103
PID 1164 wrote to memory of 3436	1164	explorer.exe	104
PID 1164 wrote to memory of 3436	1164	explorer.exe	104
PID 1164 wrote to memory of 3436	1164	explorer.exe	104
PID 1164 wrote to memory of 3956	1164	explorer.exe	105
PID 1164 wrote to memory of 3956	1164	explorer.exe	105
PID 1164 wrote to memory of 3956	1164	explorer.exe	105
PID 1164 wrote to memory of 4012	1164	explorer.exe	106
PID 1164 wrote to memory of 4012	1164	explorer.exe	106
PID 1164 wrote to memory of 4012	1164	explorer.exe	106
PID 1164 wrote to memory of 784	1164	explorer.exe	107
PID 1164 wrote to memory of 784	1164	explorer.exe	107
PID 1164 wrote to memory of 784	1164	explorer.exe	107
PID 1164 wrote to memory of 1108	1164	explorer.exe	108
PID 1164 wrote to memory of 1108	1164	explorer.exe	108
PID 1164 wrote to memory of 1108	1164	explorer.exe	108
PID 1164 wrote to memory of 1032	1164	explorer.exe	109
PID 1164 wrote to memory of 1032	1164	explorer.exe	109
PID 1164 wrote to memory of 1032	1164	explorer.exe	109
PID 1164 wrote to memory of 2700	1164	explorer.exe	110
PID 1164 wrote to memory of 2700	1164	explorer.exe	110
PID 1164 wrote to memory of 2700	1164	explorer.exe	110
PID 1164 wrote to memory of 1184	1164	explorer.exe	111
PID 1164 wrote to memory of 1184	1164	explorer.exe	111
PID 1164 wrote to memory of 1184	1164	explorer.exe	111
PID 1164 wrote to memory of 1668	1164	explorer.exe	112
PID 1164 wrote to memory of 1668	1164	explorer.exe	112
PID 1164 wrote to memory of 1668	1164	explorer.exe	112
PID 1164 wrote to memory of 2364	1164	explorer.exe	113
PID 1164 wrote to memory of 2364	1164	explorer.exe	113
PID 1164 wrote to memory of 2364	1164	explorer.exe	113
PID 1164 wrote to memory of 2324	1164	explorer.exe	114
PID 1164 wrote to memory of 2324	1164	explorer.exe	114
PID 1164 wrote to memory of 2324	1164	explorer.exe	114
PID 1164 wrote to memory of 3328	1164	explorer.exe	115
PID 1164 wrote to memory of 3328	1164	explorer.exe	115
PID 1164 wrote to memory of 3328	1164	explorer.exe	115
PID 1164 wrote to memory of 2428	1164	explorer.exe	116
PID 1164 wrote to memory of 2428	1164	explorer.exe	116
PID 1164 wrote to memory of 2428	1164	explorer.exe	116
PID 1164 wrote to memory of 4028	1164	explorer.exe	117
PID 1164 wrote to memory of 4028	1164	explorer.exe	117
PID 1164 wrote to memory of 4028	1164	explorer.exe	117
PID 1164 wrote to memory of 1948	1164	explorer.exe	118
PID 1164 wrote to memory of 1948	1164	explorer.exe	118
PID 1164 wrote to memory of 1948	1164	explorer.exe	118
PID 1164 wrote to memory of 1116	1164	explorer.exe	119
PID 1164 wrote to memory of 1116	1164	explorer.exe	119
PID 1164 wrote to memory of 1116	1164	explorer.exe	119
PID 1164 wrote to memory of 2576	1164	explorer.exe	120
PID 1164 wrote to memory of 2576	1164	explorer.exe	120
PID 1164 wrote to memory of 2576	1164	explorer.exe	120
PID 1164 wrote to memory of 1964	1164	explorer.exe	121
PID 1164 wrote to memory of 1964	1164	explorer.exe	121
PID 1164 wrote to memory of 1964	1164	explorer.exe	121
PID 1164 wrote to memory of 4128	1164	explorer.exe	122
PID 1164 wrote to memory of 4128	1164	explorer.exe	122
PID 1164 wrote to memory of 4128	1164	explorer.exe	122
PID 1164 wrote to memory of 4160	1164	explorer.exe	123
PID 1164 wrote to memory of 4160	1164	explorer.exe	123
PID 1164 wrote to memory of 4160	1164	explorer.exe	123
PID 1164 wrote to memory of 4192	1164	explorer.exe	124
PID 1164 wrote to memory of 4192	1164	explorer.exe	124
PID 1164 wrote to memory of 4192	1164	explorer.exe	124
PID 1164 wrote to memory of 4224	1164	explorer.exe	125
PID 1164 wrote to memory of 4224	1164	explorer.exe	125
PID 1164 wrote to memory of 4224	1164	explorer.exe	125
PID 1164 wrote to memory of 4256	1164	explorer.exe	126
PID 1164 wrote to memory of 4256	1164	explorer.exe	126
PID 1164 wrote to memory of 4256	1164	explorer.exe	126
PID 1164 wrote to memory of 4288	1164	explorer.exe	127
PID 1164 wrote to memory of 4288	1164	explorer.exe	127
PID 1164 wrote to memory of 4288	1164	explorer.exe	127
PID 1164 wrote to memory of 4320	1164	explorer.exe	128
PID 1164 wrote to memory of 4320	1164	explorer.exe	128
PID 1164 wrote to memory of 4320	1164	explorer.exe	128
PID 1164 wrote to memory of 4352	1164	explorer.exe	129
PID 1164 wrote to memory of 4352	1164	explorer.exe	129
PID 1164 wrote to memory of 4352	1164	explorer.exe	129
PID 1164 wrote to memory of 4384	1164	explorer.exe	130
PID 1164 wrote to memory of 4384	1164	explorer.exe	130
PID 1164 wrote to memory of 4384	1164	explorer.exe	130
PID 1164 wrote to memory of 4416	1164	explorer.exe	131
PID 1164 wrote to memory of 4416	1164	explorer.exe	131
PID 1164 wrote to memory of 4416	1164	explorer.exe	131
PID 1164 wrote to memory of 4448	1164	explorer.exe	132
PID 1164 wrote to memory of 4448	1164	explorer.exe	132
PID 1164 wrote to memory of 4448	1164	explorer.exe	132
PID 1164 wrote to memory of 4480	1164	explorer.exe	133
PID 1164 wrote to memory of 4480	1164	explorer.exe	133
PID 1164 wrote to memory of 4480	1164	explorer.exe	133
PID 1164 wrote to memory of 4512	1164	explorer.exe	134
PID 1164 wrote to memory of 4512	1164	explorer.exe	134
PID 1164 wrote to memory of 4512	1164	explorer.exe	134
PID 1164 wrote to memory of 4544	1164	explorer.exe	135
PID 1164 wrote to memory of 4544	1164	explorer.exe	135
PID 1164 wrote to memory of 4544	1164	explorer.exe	135
PID 1164 wrote to memory of 4576	1164	explorer.exe	136
PID 1164 wrote to memory of 4576	1164	explorer.exe	136
PID 1164 wrote to memory of 4576	1164	explorer.exe	136
PID 1164 wrote to memory of 4608	1164	explorer.exe	137
PID 1164 wrote to memory of 4608	1164	explorer.exe	137
PID 1164 wrote to memory of 4608	1164	explorer.exe	137
PID 1164 wrote to memory of 4644	1164	explorer.exe	138
PID 1164 wrote to memory of 4644	1164	explorer.exe	138
PID 1164 wrote to memory of 4644	1164	explorer.exe	138
PID 1164 wrote to memory of 4676	1164	explorer.exe	139
PID 1164 wrote to memory of 4676	1164	explorer.exe	139
PID 1164 wrote to memory of 4676	1164	explorer.exe	139
PID 1164 wrote to memory of 4708	1164	explorer.exe	140
PID 1164 wrote to memory of 4708	1164	explorer.exe	140
PID 1164 wrote to memory of 4708	1164	explorer.exe	140
PID 1164 wrote to memory of 4740	1164	explorer.exe	141
PID 1164 wrote to memory of 4740	1164	explorer.exe	141
PID 1164 wrote to memory of 4740	1164	explorer.exe	141
PID 1164 wrote to memory of 4772	1164	explorer.exe	142
PID 1164 wrote to memory of 4772	1164	explorer.exe	142
PID 1164 wrote to memory of 4772	1164	explorer.exe	142
PID 1164 wrote to memory of 4804	1164	explorer.exe	143
PID 1164 wrote to memory of 4804	1164	explorer.exe	143
PID 1164 wrote to memory of 4804	1164	explorer.exe	143
PID 1164 wrote to memory of 4836	1164	explorer.exe	144
PID 1164 wrote to memory of 4836	1164	explorer.exe	144
PID 1164 wrote to memory of 4836	1164	explorer.exe	144
PID 1164 wrote to memory of 4868	1164	explorer.exe	145
PID 1164 wrote to memory of 4868	1164	explorer.exe	145
PID 1164 wrote to memory of 4868	1164	explorer.exe	145
PID 1164 wrote to memory of 4900	1164	explorer.exe	146
PID 1164 wrote to memory of 4900	1164	explorer.exe	146
PID 1164 wrote to memory of 4900	1164	explorer.exe	146
PID 1164 wrote to memory of 4932	1164	explorer.exe	147
PID 1164 wrote to memory of 4932	1164	explorer.exe	147
PID 1164 wrote to memory of 4932	1164	explorer.exe	147
PID 1164 wrote to memory of 4964	1164	explorer.exe	148
PID 1164 wrote to memory of 4964	1164	explorer.exe	148
PID 1164 wrote to memory of 4964	1164	explorer.exe	148
PID 1164 wrote to memory of 4996	1164	explorer.exe	149
PID 1164 wrote to memory of 4996	1164	explorer.exe	149
PID 1164 wrote to memory of 4996	1164	explorer.exe	149
PID 1164 wrote to memory of 5028	1164	explorer.exe	150
PID 1164 wrote to memory of 5028	1164	explorer.exe	150
PID 1164 wrote to memory of 5028	1164	explorer.exe	150
PID 1164 wrote to memory of 5060	1164	explorer.exe	151
PID 1164 wrote to memory of 5060	1164	explorer.exe	151
PID 1164 wrote to memory of 5060	1164	explorer.exe	151
PID 1164 wrote to memory of 5092	1164	explorer.exe	152
PID 1164 wrote to memory of 5092	1164	explorer.exe	152
PID 1164 wrote to memory of 5092	1164	explorer.exe	152
PID 1164 wrote to memory of 4008	1164	explorer.exe	153
PID 1164 wrote to memory of 4008	1164	explorer.exe	153
PID 1164 wrote to memory of 4008	1164	explorer.exe	153
PID 1164 wrote to memory of 4188	1164	explorer.exe	154
PID 1164 wrote to memory of 4188	1164	explorer.exe	154
PID 1164 wrote to memory of 4188	1164	explorer.exe	154
PID 1164 wrote to memory of 4252	1164	explorer.exe	155
PID 1164 wrote to memory of 4252	1164	explorer.exe	155
PID 1164 wrote to memory of 4252	1164	explorer.exe	155
PID 1164 wrote to memory of 3536	1164	explorer.exe	156
PID 1164 wrote to memory of 3536	1164	explorer.exe	156
PID 1164 wrote to memory of 3536	1164	explorer.exe	156
PID 1164 wrote to memory of 4380	1164	explorer.exe	157
PID 1164 wrote to memory of 4380	1164	explorer.exe	157
PID 1164 wrote to memory of 4380	1164	explorer.exe	157
PID 1164 wrote to memory of 4444	1164	explorer.exe	158
PID 1164 wrote to memory of 4444	1164	explorer.exe	158
PID 1164 wrote to memory of 4444	1164	explorer.exe	158
PID 1164 wrote to memory of 4332	1164	explorer.exe	159
PID 1164 wrote to memory of 4332	1164	explorer.exe	159
PID 1164 wrote to memory of 4332	1164	explorer.exe	159
PID 1164 wrote to memory of 4604	1164	explorer.exe	160
PID 1164 wrote to memory of 4604	1164	explorer.exe	160
PID 1164 wrote to memory of 4604	1164	explorer.exe	160
PID 1164 wrote to memory of 4652	1164	explorer.exe	161
PID 1164 wrote to memory of 4652	1164	explorer.exe	161
PID 1164 wrote to memory of 4652	1164	explorer.exe	161
PID 1164 wrote to memory of 4732	1164	explorer.exe	162
PID 1164 wrote to memory of 4732	1164	explorer.exe	162
PID 1164 wrote to memory of 4732	1164	explorer.exe	162
PID 1164 wrote to memory of 3544	1164	explorer.exe	163
PID 1164 wrote to memory of 3544	1164	explorer.exe	163
PID 1164 wrote to memory of 3544	1164	explorer.exe	163
PID 1164 wrote to memory of 4864	1164	explorer.exe	164
PID 1164 wrote to memory of 4864	1164	explorer.exe	164
PID 1164 wrote to memory of 4864	1164	explorer.exe	164
PID 1164 wrote to memory of 4940	1164	explorer.exe	165
PID 1164 wrote to memory of 4940	1164	explorer.exe	165
PID 1164 wrote to memory of 4940	1164	explorer.exe	165
PID 1164 wrote to memory of 5020	1164	explorer.exe	166
PID 1164 wrote to memory of 5020	1164	explorer.exe	166
PID 1164 wrote to memory of 5020	1164	explorer.exe	166
PID 1164 wrote to memory of 4688	1164	explorer.exe	167
PID 1164 wrote to memory of 4688	1164	explorer.exe	167
PID 1164 wrote to memory of 4688	1164	explorer.exe	167
PID 1164 wrote to memory of 4168	1164	explorer.exe	168
PID 1164 wrote to memory of 4168	1164	explorer.exe	168
PID 1164 wrote to memory of 4168	1164	explorer.exe	168
PID 1164 wrote to memory of 4360	1164	explorer.exe	169
PID 1164 wrote to memory of 4360	1164	explorer.exe	169
PID 1164 wrote to memory of 4360	1164	explorer.exe	169
PID 1164 wrote to memory of 4536	1164	explorer.exe	170
PID 1164 wrote to memory of 4536	1164	explorer.exe	170
PID 1164 wrote to memory of 4536	1164	explorer.exe	170
PID 1164 wrote to memory of 5104	1164	explorer.exe	171
PID 1164 wrote to memory of 5104	1164	explorer.exe	171
PID 1164 wrote to memory of 5104	1164	explorer.exe	171
PID 1164 wrote to memory of 4796	1164	explorer.exe	172
PID 1164 wrote to memory of 4796	1164	explorer.exe	172
PID 1164 wrote to memory of 4796	1164	explorer.exe	172
PID 1164 wrote to memory of 4956	1164	explorer.exe	173
PID 1164 wrote to memory of 4956	1164	explorer.exe	173
PID 1164 wrote to memory of 4956	1164	explorer.exe	173
PID 1164 wrote to memory of 4088	1164	explorer.exe	174
PID 1164 wrote to memory of 4088	1164	explorer.exe	174
PID 1164 wrote to memory of 4088	1164	explorer.exe	174
PID 1164 wrote to memory of 4568	1164	explorer.exe	175
PID 1164 wrote to memory of 4568	1164	explorer.exe	175
PID 1164 wrote to memory of 4568	1164	explorer.exe	175
PID 1164 wrote to memory of 4928	1164	explorer.exe	176
PID 1164 wrote to memory of 4928	1164	explorer.exe	176
PID 1164 wrote to memory of 4928	1164	explorer.exe	176
PID 1164 wrote to memory of 4492	1164	explorer.exe	177
PID 1164 wrote to memory of 4492	1164	explorer.exe	177
PID 1164 wrote to memory of 4492	1164	explorer.exe	177
PID 1164 wrote to memory of 5124	1164	explorer.exe	178
PID 1164 wrote to memory of 5124	1164	explorer.exe	178
PID 1164 wrote to memory of 5124	1164	explorer.exe	178
PID 1164 wrote to memory of 5156	1164	explorer.exe	179
PID 1164 wrote to memory of 5156	1164	explorer.exe	179
PID 1164 wrote to memory of 5156	1164	explorer.exe	179
PID 1164 wrote to memory of 5188	1164	explorer.exe	180
PID 1164 wrote to memory of 5188	1164	explorer.exe	180
PID 1164 wrote to memory of 5188	1164	explorer.exe	180
PID 1164 wrote to memory of 5220	1164	explorer.exe	181
PID 1164 wrote to memory of 5220	1164	explorer.exe	181

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3920 set thread context of 3968	3920	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe	67
PID 3920 set thread context of 3848	3920	3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe	68
PID 3536 set thread context of 1164	3536	explorer.exe	76
PID 3536 set thread context of 3780	3536	explorer.exe	77

C:\Users\Admin\AppData\Local\Temp\3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe
"C:\Users\Admin\AppData\Local\Temp\3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe"
1⤵
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3920
- C:\Users\Admin\AppData\Local\Temp\3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe
  "C:\Users\Admin\AppData\Local\Temp\3ce3a22ed2e67a2eefc56c514a4deb6650b91bfe28ed32edbe82e2627c063ebe.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious behavior: EnumeratesProcesses
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3968
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Adds Run entry to start application
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    - Suspicious use of SetThreadContext
    PID:3536
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Adds Run entry to start application
      Modifies WinLogon for persistence
      Suspicious use of SetWindowsHookEx
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Drops file in Windows directory
      Modifies Installed Components in the registry
      Modifies the visibility of hidden or system files
      Suspicious use of WriteProcessMemory
      PID:1164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3172
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:784
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4088
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5156
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5220
  - - C:\Windows\SysWOW64\diskperf.exe
      "C:\Windows\SysWOW64\diskperf.exe"
      4⤵
      PID:3780
- C:\Windows\SysWOW64\diskperf.exe
  "C:\Windows\SysWOW64\diskperf.exe"
  2⤵
  PID:3848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1164-223-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-64-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-128-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-131-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-132-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-440-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-127-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-135-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-136-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-439-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-436-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-139-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-140-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-435-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-124-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-143-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-144-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-123-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-432-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-147-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-148-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-120-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-119-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-151-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-152-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-431-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-116-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-155-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-156-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-428-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-115-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-159-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-160-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-427-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-424-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-163-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-164-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-423-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-112-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-167-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-168-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-420-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-111-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-171-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-172-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-419-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-416-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-175-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-176-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-415-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-107-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-179-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-180-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-412-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-108-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-183-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-184-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-411-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-104-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-187-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-188-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-408-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-103-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-191-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-192-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-100-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-99-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-195-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-196-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-407-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-199-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-200-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-404-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-96-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-203-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-204-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-403-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-95-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-207-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-208-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-400-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-92-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-211-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-212-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-399-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-91-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-215-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-216-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-396-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-88-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-219-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-220-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-395-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-87-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-29-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-224-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-392-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-391-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-227-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-228-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-30-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-84-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-231-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-232-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-388-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-83-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-235-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-236-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-387-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-31-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-239-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-240-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-384-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-80-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-243-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-244-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-383-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-79-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-247-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-248-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-32-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-380-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-251-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-252-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-379-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-76-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-255-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-256-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-376-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-75-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-259-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-260-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-375-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-72-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-263-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-264-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-35-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-71-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-267-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-268-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-372-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-371-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-271-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-272-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-36-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-68-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-275-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-276-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-368-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-67-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-279-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-280-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-367-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-364-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-283-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-284-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-363-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-39-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-287-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-288-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-360-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-63-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-291-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-292-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-359-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-40-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-295-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-296-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-356-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-60-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-299-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-300-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-355-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-59-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-303-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-304-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-352-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-351-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-307-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-308-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-43-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-56-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-311-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-312-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-348-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-55-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-315-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-316-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-347-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-44-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-319-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-320-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-344-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-52-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-323-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-324-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-343-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-51-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-327-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-328-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-340-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-339-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-331-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-332-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-47-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-48-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1164-335-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1164-336-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/3848-6-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3848-3-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3968-2-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3968-10-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/3968-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3968-9-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download