c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682

Analysis

max time kernel
136s
max time network
49s
platform
windows10_x64
resource
win10v200430
submitted
29/06/2020, 07:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe
Size 1.8MB
Sample200629-lfl82ef56x
SHA256 c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682
MD5 92e7599aa1a5ff5130477bcebeccf75d
SHA1 4ecedfb18ba88d4263cf01138df1e759c32aea79
SHA512 c1cceea33113acdff217bde25687621e20b077d1ffa0c5487eadbfab42aab0b0d5bf9fd1d6861ad9fc079bd4168cc80c1b3e8cd4a4f0e943d88ce683191d58a3
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2500	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe
2500	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
6120	spoolsv.exe
6120	spoolsv.exe

Executes dropped EXE 147 IoCs

pid	Process
3856	explorer.exe
4044	explorer.exe
3972	spoolsv.exe
1476	spoolsv.exe
1912	spoolsv.exe
3692	spoolsv.exe
3492	spoolsv.exe
412	spoolsv.exe
496	spoolsv.exe
2056	spoolsv.exe
3992	spoolsv.exe
3776	spoolsv.exe
820	spoolsv.exe
908	spoolsv.exe
1116	spoolsv.exe
1544	spoolsv.exe
3748	spoolsv.exe
2204	spoolsv.exe
2104	spoolsv.exe
2180	spoolsv.exe
1276	spoolsv.exe
3516	spoolsv.exe
3712	spoolsv.exe
1004	spoolsv.exe
1728	spoolsv.exe
2244	spoolsv.exe
3856	spoolsv.exe
3820	spoolsv.exe
2328	spoolsv.exe
3012	spoolsv.exe
3996	spoolsv.exe
3032	spoolsv.exe
3796	spoolsv.exe
988	spoolsv.exe
2660	spoolsv.exe
2196	spoolsv.exe
1968	spoolsv.exe
3508	spoolsv.exe
3928	spoolsv.exe
3864	spoolsv.exe
3816	spoolsv.exe
3444	spoolsv.exe
3336	spoolsv.exe
1996	spoolsv.exe
2188	spoolsv.exe
1796	spoolsv.exe
3016	spoolsv.exe
4004	spoolsv.exe
2280	spoolsv.exe
1432	spoolsv.exe
3880	spoolsv.exe
3160	spoolsv.exe
1660	spoolsv.exe
4120	spoolsv.exe
4152	spoolsv.exe
4184	spoolsv.exe
4216	spoolsv.exe
4248	spoolsv.exe
4280	spoolsv.exe
4312	spoolsv.exe
4344	spoolsv.exe
4376	spoolsv.exe
4408	spoolsv.exe
4440	spoolsv.exe
4472	spoolsv.exe
4504	spoolsv.exe
4536	spoolsv.exe
4568	spoolsv.exe
4600	spoolsv.exe
4632	spoolsv.exe
4668	spoolsv.exe
4704	spoolsv.exe
4736	spoolsv.exe
4768	spoolsv.exe
4800	spoolsv.exe
4832	spoolsv.exe
4864	spoolsv.exe
4896	spoolsv.exe
4928	spoolsv.exe
4960	spoolsv.exe
4992	spoolsv.exe
5028	spoolsv.exe
5060	spoolsv.exe
5092	spoolsv.exe
4100	spoolsv.exe
4164	spoolsv.exe
4228	spoolsv.exe
4292	spoolsv.exe
4356	spoolsv.exe
4420	spoolsv.exe
4484	spoolsv.exe
4532	spoolsv.exe
4608	spoolsv.exe
4676	spoolsv.exe
4744	spoolsv.exe
4808	spoolsv.exe
4872	spoolsv.exe
4940	spoolsv.exe
5004	spoolsv.exe
5084	spoolsv.exe
4148	spoolsv.exe
4276	spoolsv.exe
4404	spoolsv.exe
4516	spoolsv.exe
4660	spoolsv.exe
4796	spoolsv.exe
4936	spoolsv.exe
5072	spoolsv.exe
4256	spoolsv.exe
4512	spoolsv.exe
4760	spoolsv.exe
64	spoolsv.exe
4320	spoolsv.exe
4700	spoolsv.exe
4244	spoolsv.exe
5068	spoolsv.exe
2308	spoolsv.exe
5144	spoolsv.exe
5176	spoolsv.exe
5208	spoolsv.exe
5240	spoolsv.exe
5272	spoolsv.exe
5304	spoolsv.exe
5336	spoolsv.exe
5372	spoolsv.exe
5408	spoolsv.exe
5440	spoolsv.exe
5472	spoolsv.exe
5504	spoolsv.exe
5536	spoolsv.exe
5572	spoolsv.exe
5604	spoolsv.exe
5636	spoolsv.exe
5668	spoolsv.exe
5700	spoolsv.exe
5736	spoolsv.exe
5768	spoolsv.exe
5800	spoolsv.exe
5832	spoolsv.exe
5864	spoolsv.exe
5896	spoolsv.exe
5976	spoolsv.exe
6060	spoolsv.exe
6096	spoolsv.exe
6120	spoolsv.exe
5188	spoolsv.exe
5216	spoolsv.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4044	explorer.exe

Modifies the visibility of hidden or system files 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Suspicious use of WriteProcessMemory 490 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2500	2908	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe	72
PID 2908 wrote to memory of 2500	2908	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe	72
PID 2908 wrote to memory of 2500	2908	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe	72
PID 2908 wrote to memory of 2500	2908	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe	72
PID 2908 wrote to memory of 2500	2908	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe	72
PID 2908 wrote to memory of 2500	2908	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe	72
PID 2908 wrote to memory of 2500	2908	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe	72
PID 2908 wrote to memory of 2500	2908	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe	72
PID 2908 wrote to memory of 2764	2908	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe	73
PID 2908 wrote to memory of 2764	2908	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe	73
PID 2908 wrote to memory of 2764	2908	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe	73
PID 2908 wrote to memory of 2764	2908	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe	73
PID 2908 wrote to memory of 2764	2908	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe	73
PID 2500 wrote to memory of 3856	2500	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe	74
PID 2500 wrote to memory of 3856	2500	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe	74
PID 2500 wrote to memory of 3856	2500	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe	74
PID 3856 wrote to memory of 4044	3856	explorer.exe	75
PID 3856 wrote to memory of 4044	3856	explorer.exe	75
PID 3856 wrote to memory of 4044	3856	explorer.exe	75
PID 3856 wrote to memory of 4044	3856	explorer.exe	75
PID 3856 wrote to memory of 4044	3856	explorer.exe	75
PID 3856 wrote to memory of 4044	3856	explorer.exe	75
PID 3856 wrote to memory of 4044	3856	explorer.exe	75
PID 3856 wrote to memory of 4044	3856	explorer.exe	75
PID 3856 wrote to memory of 3340	3856	explorer.exe	76
PID 3856 wrote to memory of 3340	3856	explorer.exe	76
PID 3856 wrote to memory of 3340	3856	explorer.exe	76
PID 3856 wrote to memory of 3340	3856	explorer.exe	76
PID 3856 wrote to memory of 3340	3856	explorer.exe	76
PID 4044 wrote to memory of 3972	4044	explorer.exe	77
PID 4044 wrote to memory of 3972	4044	explorer.exe	77
PID 4044 wrote to memory of 3972	4044	explorer.exe	77
PID 4044 wrote to memory of 1476	4044	explorer.exe	78
PID 4044 wrote to memory of 1476	4044	explorer.exe	78
PID 4044 wrote to memory of 1476	4044	explorer.exe	78
PID 4044 wrote to memory of 1912	4044	explorer.exe	79
PID 4044 wrote to memory of 1912	4044	explorer.exe	79
PID 4044 wrote to memory of 1912	4044	explorer.exe	79
PID 4044 wrote to memory of 3692	4044	explorer.exe	80
PID 4044 wrote to memory of 3692	4044	explorer.exe	80
PID 4044 wrote to memory of 3692	4044	explorer.exe	80
PID 4044 wrote to memory of 3492	4044	explorer.exe	81
PID 4044 wrote to memory of 3492	4044	explorer.exe	81
PID 4044 wrote to memory of 3492	4044	explorer.exe	81
PID 4044 wrote to memory of 412	4044	explorer.exe	82
PID 4044 wrote to memory of 412	4044	explorer.exe	82
PID 4044 wrote to memory of 412	4044	explorer.exe	82
PID 4044 wrote to memory of 496	4044	explorer.exe	83
PID 4044 wrote to memory of 496	4044	explorer.exe	83
PID 4044 wrote to memory of 496	4044	explorer.exe	83
PID 4044 wrote to memory of 2056	4044	explorer.exe	84
PID 4044 wrote to memory of 2056	4044	explorer.exe	84
PID 4044 wrote to memory of 2056	4044	explorer.exe	84
PID 4044 wrote to memory of 3992	4044	explorer.exe	85
PID 4044 wrote to memory of 3992	4044	explorer.exe	85
PID 4044 wrote to memory of 3992	4044	explorer.exe	85
PID 4044 wrote to memory of 3776	4044	explorer.exe	86
PID 4044 wrote to memory of 3776	4044	explorer.exe	86
PID 4044 wrote to memory of 3776	4044	explorer.exe	86
PID 4044 wrote to memory of 820	4044	explorer.exe	87
PID 4044 wrote to memory of 820	4044	explorer.exe	87
PID 4044 wrote to memory of 820	4044	explorer.exe	87
PID 4044 wrote to memory of 908	4044	explorer.exe	88
PID 4044 wrote to memory of 908	4044	explorer.exe	88
PID 4044 wrote to memory of 908	4044	explorer.exe	88
PID 4044 wrote to memory of 1116	4044	explorer.exe	89
PID 4044 wrote to memory of 1116	4044	explorer.exe	89
PID 4044 wrote to memory of 1116	4044	explorer.exe	89
PID 4044 wrote to memory of 1544	4044	explorer.exe	90
PID 4044 wrote to memory of 1544	4044	explorer.exe	90
PID 4044 wrote to memory of 1544	4044	explorer.exe	90
PID 4044 wrote to memory of 3748	4044	explorer.exe	91
PID 4044 wrote to memory of 3748	4044	explorer.exe	91
PID 4044 wrote to memory of 3748	4044	explorer.exe	91
PID 4044 wrote to memory of 2204	4044	explorer.exe	92
PID 4044 wrote to memory of 2204	4044	explorer.exe	92
PID 4044 wrote to memory of 2204	4044	explorer.exe	92
PID 4044 wrote to memory of 2104	4044	explorer.exe	93
PID 4044 wrote to memory of 2104	4044	explorer.exe	93
PID 4044 wrote to memory of 2104	4044	explorer.exe	93
PID 4044 wrote to memory of 2180	4044	explorer.exe	94
PID 4044 wrote to memory of 2180	4044	explorer.exe	94
PID 4044 wrote to memory of 2180	4044	explorer.exe	94
PID 4044 wrote to memory of 1276	4044	explorer.exe	95
PID 4044 wrote to memory of 1276	4044	explorer.exe	95
PID 4044 wrote to memory of 1276	4044	explorer.exe	95
PID 4044 wrote to memory of 3516	4044	explorer.exe	96
PID 4044 wrote to memory of 3516	4044	explorer.exe	96
PID 4044 wrote to memory of 3516	4044	explorer.exe	96
PID 4044 wrote to memory of 3712	4044	explorer.exe	97
PID 4044 wrote to memory of 3712	4044	explorer.exe	97
PID 4044 wrote to memory of 3712	4044	explorer.exe	97
PID 4044 wrote to memory of 1004	4044	explorer.exe	98
PID 4044 wrote to memory of 1004	4044	explorer.exe	98
PID 4044 wrote to memory of 1004	4044	explorer.exe	98
PID 4044 wrote to memory of 1728	4044	explorer.exe	99
PID 4044 wrote to memory of 1728	4044	explorer.exe	99
PID 4044 wrote to memory of 1728	4044	explorer.exe	99
PID 4044 wrote to memory of 2244	4044	explorer.exe	100
PID 4044 wrote to memory of 2244	4044	explorer.exe	100
PID 4044 wrote to memory of 2244	4044	explorer.exe	100
PID 4044 wrote to memory of 3856	4044	explorer.exe	101
PID 4044 wrote to memory of 3856	4044	explorer.exe	101
PID 4044 wrote to memory of 3856	4044	explorer.exe	101
PID 4044 wrote to memory of 3820	4044	explorer.exe	102
PID 4044 wrote to memory of 3820	4044	explorer.exe	102
PID 4044 wrote to memory of 3820	4044	explorer.exe	102
PID 4044 wrote to memory of 2328	4044	explorer.exe	103
PID 4044 wrote to memory of 2328	4044	explorer.exe	103
PID 4044 wrote to memory of 2328	4044	explorer.exe	103
PID 4044 wrote to memory of 3012	4044	explorer.exe	104
PID 4044 wrote to memory of 3012	4044	explorer.exe	104
PID 4044 wrote to memory of 3012	4044	explorer.exe	104
PID 4044 wrote to memory of 3996	4044	explorer.exe	105
PID 4044 wrote to memory of 3996	4044	explorer.exe	105
PID 4044 wrote to memory of 3996	4044	explorer.exe	105
PID 4044 wrote to memory of 3032	4044	explorer.exe	106
PID 4044 wrote to memory of 3032	4044	explorer.exe	106
PID 4044 wrote to memory of 3032	4044	explorer.exe	106
PID 4044 wrote to memory of 3796	4044	explorer.exe	107
PID 4044 wrote to memory of 3796	4044	explorer.exe	107
PID 4044 wrote to memory of 3796	4044	explorer.exe	107
PID 4044 wrote to memory of 988	4044	explorer.exe	108
PID 4044 wrote to memory of 988	4044	explorer.exe	108
PID 4044 wrote to memory of 988	4044	explorer.exe	108
PID 4044 wrote to memory of 2660	4044	explorer.exe	109
PID 4044 wrote to memory of 2660	4044	explorer.exe	109
PID 4044 wrote to memory of 2660	4044	explorer.exe	109
PID 4044 wrote to memory of 2196	4044	explorer.exe	110
PID 4044 wrote to memory of 2196	4044	explorer.exe	110
PID 4044 wrote to memory of 2196	4044	explorer.exe	110
PID 4044 wrote to memory of 1968	4044	explorer.exe	111
PID 4044 wrote to memory of 1968	4044	explorer.exe	111
PID 4044 wrote to memory of 1968	4044	explorer.exe	111
PID 4044 wrote to memory of 3508	4044	explorer.exe	112
PID 4044 wrote to memory of 3508	4044	explorer.exe	112
PID 4044 wrote to memory of 3508	4044	explorer.exe	112
PID 4044 wrote to memory of 3928	4044	explorer.exe	113
PID 4044 wrote to memory of 3928	4044	explorer.exe	113
PID 4044 wrote to memory of 3928	4044	explorer.exe	113
PID 4044 wrote to memory of 3864	4044	explorer.exe	114
PID 4044 wrote to memory of 3864	4044	explorer.exe	114
PID 4044 wrote to memory of 3864	4044	explorer.exe	114
PID 4044 wrote to memory of 3816	4044	explorer.exe	115
PID 4044 wrote to memory of 3816	4044	explorer.exe	115
PID 4044 wrote to memory of 3816	4044	explorer.exe	115
PID 4044 wrote to memory of 3444	4044	explorer.exe	116
PID 4044 wrote to memory of 3444	4044	explorer.exe	116
PID 4044 wrote to memory of 3444	4044	explorer.exe	116
PID 4044 wrote to memory of 3336	4044	explorer.exe	117
PID 4044 wrote to memory of 3336	4044	explorer.exe	117
PID 4044 wrote to memory of 3336	4044	explorer.exe	117
PID 4044 wrote to memory of 1996	4044	explorer.exe	118
PID 4044 wrote to memory of 1996	4044	explorer.exe	118
PID 4044 wrote to memory of 1996	4044	explorer.exe	118
PID 4044 wrote to memory of 2188	4044	explorer.exe	119
PID 4044 wrote to memory of 2188	4044	explorer.exe	119
PID 4044 wrote to memory of 2188	4044	explorer.exe	119
PID 4044 wrote to memory of 1796	4044	explorer.exe	120
PID 4044 wrote to memory of 1796	4044	explorer.exe	120
PID 4044 wrote to memory of 1796	4044	explorer.exe	120
PID 4044 wrote to memory of 3016	4044	explorer.exe	121
PID 4044 wrote to memory of 3016	4044	explorer.exe	121
PID 4044 wrote to memory of 3016	4044	explorer.exe	121
PID 4044 wrote to memory of 4004	4044	explorer.exe	122
PID 4044 wrote to memory of 4004	4044	explorer.exe	122
PID 4044 wrote to memory of 4004	4044	explorer.exe	122
PID 4044 wrote to memory of 2280	4044	explorer.exe	123
PID 4044 wrote to memory of 2280	4044	explorer.exe	123
PID 4044 wrote to memory of 2280	4044	explorer.exe	123
PID 4044 wrote to memory of 1432	4044	explorer.exe	124
PID 4044 wrote to memory of 1432	4044	explorer.exe	124
PID 4044 wrote to memory of 1432	4044	explorer.exe	124
PID 4044 wrote to memory of 3880	4044	explorer.exe	125
PID 4044 wrote to memory of 3880	4044	explorer.exe	125
PID 4044 wrote to memory of 3880	4044	explorer.exe	125
PID 4044 wrote to memory of 3160	4044	explorer.exe	126
PID 4044 wrote to memory of 3160	4044	explorer.exe	126
PID 4044 wrote to memory of 3160	4044	explorer.exe	126
PID 4044 wrote to memory of 1660	4044	explorer.exe	127
PID 4044 wrote to memory of 1660	4044	explorer.exe	127
PID 4044 wrote to memory of 1660	4044	explorer.exe	127
PID 4044 wrote to memory of 4120	4044	explorer.exe	128
PID 4044 wrote to memory of 4120	4044	explorer.exe	128
PID 4044 wrote to memory of 4120	4044	explorer.exe	128
PID 4044 wrote to memory of 4152	4044	explorer.exe	129
PID 4044 wrote to memory of 4152	4044	explorer.exe	129
PID 4044 wrote to memory of 4152	4044	explorer.exe	129
PID 4044 wrote to memory of 4184	4044	explorer.exe	130
PID 4044 wrote to memory of 4184	4044	explorer.exe	130
PID 4044 wrote to memory of 4184	4044	explorer.exe	130
PID 4044 wrote to memory of 4216	4044	explorer.exe	131
PID 4044 wrote to memory of 4216	4044	explorer.exe	131
PID 4044 wrote to memory of 4216	4044	explorer.exe	131
PID 4044 wrote to memory of 4248	4044	explorer.exe	132
PID 4044 wrote to memory of 4248	4044	explorer.exe	132
PID 4044 wrote to memory of 4248	4044	explorer.exe	132
PID 4044 wrote to memory of 4280	4044	explorer.exe	133
PID 4044 wrote to memory of 4280	4044	explorer.exe	133
PID 4044 wrote to memory of 4280	4044	explorer.exe	133
PID 4044 wrote to memory of 4312	4044	explorer.exe	134
PID 4044 wrote to memory of 4312	4044	explorer.exe	134
PID 4044 wrote to memory of 4312	4044	explorer.exe	134
PID 4044 wrote to memory of 4344	4044	explorer.exe	135
PID 4044 wrote to memory of 4344	4044	explorer.exe	135
PID 4044 wrote to memory of 4344	4044	explorer.exe	135
PID 4044 wrote to memory of 4376	4044	explorer.exe	136
PID 4044 wrote to memory of 4376	4044	explorer.exe	136
PID 4044 wrote to memory of 4376	4044	explorer.exe	136
PID 4044 wrote to memory of 4408	4044	explorer.exe	137
PID 4044 wrote to memory of 4408	4044	explorer.exe	137
PID 4044 wrote to memory of 4408	4044	explorer.exe	137
PID 4044 wrote to memory of 4440	4044	explorer.exe	138
PID 4044 wrote to memory of 4440	4044	explorer.exe	138
PID 4044 wrote to memory of 4440	4044	explorer.exe	138
PID 4044 wrote to memory of 4472	4044	explorer.exe	139
PID 4044 wrote to memory of 4472	4044	explorer.exe	139
PID 4044 wrote to memory of 4472	4044	explorer.exe	139
PID 4044 wrote to memory of 4504	4044	explorer.exe	140
PID 4044 wrote to memory of 4504	4044	explorer.exe	140
PID 4044 wrote to memory of 4504	4044	explorer.exe	140
PID 4044 wrote to memory of 4536	4044	explorer.exe	141
PID 4044 wrote to memory of 4536	4044	explorer.exe	141
PID 4044 wrote to memory of 4536	4044	explorer.exe	141
PID 4044 wrote to memory of 4568	4044	explorer.exe	142
PID 4044 wrote to memory of 4568	4044	explorer.exe	142
PID 4044 wrote to memory of 4568	4044	explorer.exe	142
PID 4044 wrote to memory of 4600	4044	explorer.exe	143
PID 4044 wrote to memory of 4600	4044	explorer.exe	143
PID 4044 wrote to memory of 4600	4044	explorer.exe	143
PID 4044 wrote to memory of 4632	4044	explorer.exe	144
PID 4044 wrote to memory of 4632	4044	explorer.exe	144
PID 4044 wrote to memory of 4632	4044	explorer.exe	144
PID 4044 wrote to memory of 4668	4044	explorer.exe	145
PID 4044 wrote to memory of 4668	4044	explorer.exe	145
PID 4044 wrote to memory of 4668	4044	explorer.exe	145
PID 4044 wrote to memory of 4704	4044	explorer.exe	146
PID 4044 wrote to memory of 4704	4044	explorer.exe	146
PID 4044 wrote to memory of 4704	4044	explorer.exe	146
PID 4044 wrote to memory of 4736	4044	explorer.exe	147
PID 4044 wrote to memory of 4736	4044	explorer.exe	147
PID 4044 wrote to memory of 4736	4044	explorer.exe	147
PID 4044 wrote to memory of 4768	4044	explorer.exe	148
PID 4044 wrote to memory of 4768	4044	explorer.exe	148
PID 4044 wrote to memory of 4768	4044	explorer.exe	148
PID 4044 wrote to memory of 4800	4044	explorer.exe	149
PID 4044 wrote to memory of 4800	4044	explorer.exe	149
PID 4044 wrote to memory of 4800	4044	explorer.exe	149
PID 4044 wrote to memory of 4832	4044	explorer.exe	150
PID 4044 wrote to memory of 4832	4044	explorer.exe	150
PID 4044 wrote to memory of 4832	4044	explorer.exe	150
PID 4044 wrote to memory of 4864	4044	explorer.exe	151
PID 4044 wrote to memory of 4864	4044	explorer.exe	151
PID 4044 wrote to memory of 4864	4044	explorer.exe	151
PID 4044 wrote to memory of 4896	4044	explorer.exe	152
PID 4044 wrote to memory of 4896	4044	explorer.exe	152
PID 4044 wrote to memory of 4896	4044	explorer.exe	152
PID 4044 wrote to memory of 4928	4044	explorer.exe	153
PID 4044 wrote to memory of 4928	4044	explorer.exe	153
PID 4044 wrote to memory of 4928	4044	explorer.exe	153
PID 4044 wrote to memory of 4960	4044	explorer.exe	154
PID 4044 wrote to memory of 4960	4044	explorer.exe	154
PID 4044 wrote to memory of 4960	4044	explorer.exe	154
PID 4044 wrote to memory of 4992	4044	explorer.exe	155
PID 4044 wrote to memory of 4992	4044	explorer.exe	155
PID 4044 wrote to memory of 4992	4044	explorer.exe	155
PID 4044 wrote to memory of 5028	4044	explorer.exe	156
PID 4044 wrote to memory of 5028	4044	explorer.exe	156
PID 4044 wrote to memory of 5028	4044	explorer.exe	156
PID 4044 wrote to memory of 5060	4044	explorer.exe	157
PID 4044 wrote to memory of 5060	4044	explorer.exe	157
PID 4044 wrote to memory of 5060	4044	explorer.exe	157
PID 4044 wrote to memory of 5092	4044	explorer.exe	158
PID 4044 wrote to memory of 5092	4044	explorer.exe	158
PID 4044 wrote to memory of 5092	4044	explorer.exe	158
PID 4044 wrote to memory of 4100	4044	explorer.exe	159
PID 4044 wrote to memory of 4100	4044	explorer.exe	159
PID 4044 wrote to memory of 4100	4044	explorer.exe	159
PID 4044 wrote to memory of 4164	4044	explorer.exe	160
PID 4044 wrote to memory of 4164	4044	explorer.exe	160
PID 4044 wrote to memory of 4164	4044	explorer.exe	160
PID 4044 wrote to memory of 4228	4044	explorer.exe	161
PID 4044 wrote to memory of 4228	4044	explorer.exe	161
PID 4044 wrote to memory of 4228	4044	explorer.exe	161
PID 4044 wrote to memory of 4292	4044	explorer.exe	162
PID 4044 wrote to memory of 4292	4044	explorer.exe	162
PID 4044 wrote to memory of 4292	4044	explorer.exe	162
PID 4044 wrote to memory of 4356	4044	explorer.exe	163
PID 4044 wrote to memory of 4356	4044	explorer.exe	163
PID 4044 wrote to memory of 4356	4044	explorer.exe	163
PID 4044 wrote to memory of 4420	4044	explorer.exe	164
PID 4044 wrote to memory of 4420	4044	explorer.exe	164
PID 4044 wrote to memory of 4420	4044	explorer.exe	164
PID 4044 wrote to memory of 4484	4044	explorer.exe	165
PID 4044 wrote to memory of 4484	4044	explorer.exe	165
PID 4044 wrote to memory of 4484	4044	explorer.exe	165
PID 4044 wrote to memory of 4532	4044	explorer.exe	166
PID 4044 wrote to memory of 4532	4044	explorer.exe	166
PID 4044 wrote to memory of 4532	4044	explorer.exe	166
PID 4044 wrote to memory of 4608	4044	explorer.exe	167
PID 4044 wrote to memory of 4608	4044	explorer.exe	167
PID 4044 wrote to memory of 4608	4044	explorer.exe	167
PID 4044 wrote to memory of 4676	4044	explorer.exe	168
PID 4044 wrote to memory of 4676	4044	explorer.exe	168
PID 4044 wrote to memory of 4676	4044	explorer.exe	168
PID 4044 wrote to memory of 4744	4044	explorer.exe	169
PID 4044 wrote to memory of 4744	4044	explorer.exe	169
PID 4044 wrote to memory of 4744	4044	explorer.exe	169
PID 4044 wrote to memory of 4808	4044	explorer.exe	170
PID 4044 wrote to memory of 4808	4044	explorer.exe	170
PID 4044 wrote to memory of 4808	4044	explorer.exe	170
PID 4044 wrote to memory of 4872	4044	explorer.exe	171
PID 4044 wrote to memory of 4872	4044	explorer.exe	171
PID 4044 wrote to memory of 4872	4044	explorer.exe	171
PID 4044 wrote to memory of 4940	4044	explorer.exe	172
PID 4044 wrote to memory of 4940	4044	explorer.exe	172
PID 4044 wrote to memory of 4940	4044	explorer.exe	172
PID 4044 wrote to memory of 5004	4044	explorer.exe	173
PID 4044 wrote to memory of 5004	4044	explorer.exe	173
PID 4044 wrote to memory of 5004	4044	explorer.exe	173
PID 4044 wrote to memory of 5084	4044	explorer.exe	174
PID 4044 wrote to memory of 5084	4044	explorer.exe	174
PID 4044 wrote to memory of 5084	4044	explorer.exe	174
PID 4044 wrote to memory of 4148	4044	explorer.exe	175
PID 4044 wrote to memory of 4148	4044	explorer.exe	175
PID 4044 wrote to memory of 4148	4044	explorer.exe	175
PID 4044 wrote to memory of 4276	4044	explorer.exe	176
PID 4044 wrote to memory of 4276	4044	explorer.exe	176
PID 4044 wrote to memory of 4276	4044	explorer.exe	176
PID 4044 wrote to memory of 4404	4044	explorer.exe	177
PID 4044 wrote to memory of 4404	4044	explorer.exe	177
PID 4044 wrote to memory of 4404	4044	explorer.exe	177
PID 4044 wrote to memory of 4516	4044	explorer.exe	178
PID 4044 wrote to memory of 4516	4044	explorer.exe	178
PID 4044 wrote to memory of 4516	4044	explorer.exe	178
PID 4044 wrote to memory of 4660	4044	explorer.exe	179
PID 4044 wrote to memory of 4660	4044	explorer.exe	179
PID 4044 wrote to memory of 4660	4044	explorer.exe	179
PID 4044 wrote to memory of 4796	4044	explorer.exe	180
PID 4044 wrote to memory of 4796	4044	explorer.exe	180
PID 4044 wrote to memory of 4796	4044	explorer.exe	180
PID 4044 wrote to memory of 4936	4044	explorer.exe	181
PID 4044 wrote to memory of 4936	4044	explorer.exe	181
PID 4044 wrote to memory of 4936	4044	explorer.exe	181
PID 4044 wrote to memory of 5072	4044	explorer.exe	182
PID 4044 wrote to memory of 5072	4044	explorer.exe	182
PID 4044 wrote to memory of 5072	4044	explorer.exe	182
PID 4044 wrote to memory of 4256	4044	explorer.exe	183
PID 4044 wrote to memory of 4256	4044	explorer.exe	183
PID 4044 wrote to memory of 4256	4044	explorer.exe	183
PID 4044 wrote to memory of 4512	4044	explorer.exe	184
PID 4044 wrote to memory of 4512	4044	explorer.exe	184
PID 4044 wrote to memory of 4512	4044	explorer.exe	184
PID 4044 wrote to memory of 4760	4044	explorer.exe	185
PID 4044 wrote to memory of 4760	4044	explorer.exe	185
PID 4044 wrote to memory of 4760	4044	explorer.exe	185
PID 4044 wrote to memory of 64	4044	explorer.exe	186
PID 4044 wrote to memory of 64	4044	explorer.exe	186
PID 4044 wrote to memory of 64	4044	explorer.exe	186
PID 4044 wrote to memory of 4320	4044	explorer.exe	187
PID 4044 wrote to memory of 4320	4044	explorer.exe	187
PID 4044 wrote to memory of 4320	4044	explorer.exe	187
PID 4044 wrote to memory of 4700	4044	explorer.exe	188
PID 4044 wrote to memory of 4700	4044	explorer.exe	188
PID 4044 wrote to memory of 4700	4044	explorer.exe	188
PID 4044 wrote to memory of 4244	4044	explorer.exe	189
PID 4044 wrote to memory of 4244	4044	explorer.exe	189
PID 4044 wrote to memory of 4244	4044	explorer.exe	189
PID 4044 wrote to memory of 5068	4044	explorer.exe	190
PID 4044 wrote to memory of 5068	4044	explorer.exe	190
PID 4044 wrote to memory of 5068	4044	explorer.exe	190
PID 4044 wrote to memory of 2308	4044	explorer.exe	191
PID 4044 wrote to memory of 2308	4044	explorer.exe	191
PID 4044 wrote to memory of 2308	4044	explorer.exe	191
PID 4044 wrote to memory of 5144	4044	explorer.exe	192
PID 4044 wrote to memory of 5144	4044	explorer.exe	192
PID 4044 wrote to memory of 5144	4044	explorer.exe	192
PID 4044 wrote to memory of 5176	4044	explorer.exe	193
PID 4044 wrote to memory of 5176	4044	explorer.exe	193
PID 4044 wrote to memory of 5176	4044	explorer.exe	193
PID 4044 wrote to memory of 5208	4044	explorer.exe	194
PID 4044 wrote to memory of 5208	4044	explorer.exe	194
PID 4044 wrote to memory of 5208	4044	explorer.exe	194
PID 4044 wrote to memory of 5240	4044	explorer.exe	195
PID 4044 wrote to memory of 5240	4044	explorer.exe	195
PID 4044 wrote to memory of 5240	4044	explorer.exe	195
PID 4044 wrote to memory of 5272	4044	explorer.exe	196
PID 4044 wrote to memory of 5272	4044	explorer.exe	196
PID 4044 wrote to memory of 5272	4044	explorer.exe	196
PID 4044 wrote to memory of 5304	4044	explorer.exe	197
PID 4044 wrote to memory of 5304	4044	explorer.exe	197
PID 4044 wrote to memory of 5304	4044	explorer.exe	197
PID 4044 wrote to memory of 5336	4044	explorer.exe	198
PID 4044 wrote to memory of 5336	4044	explorer.exe	198
PID 4044 wrote to memory of 5336	4044	explorer.exe	198
PID 4044 wrote to memory of 5372	4044	explorer.exe	199
PID 4044 wrote to memory of 5372	4044	explorer.exe	199
PID 4044 wrote to memory of 5372	4044	explorer.exe	199
PID 4044 wrote to memory of 5408	4044	explorer.exe	200
PID 4044 wrote to memory of 5408	4044	explorer.exe	200
PID 4044 wrote to memory of 5408	4044	explorer.exe	200
PID 4044 wrote to memory of 5440	4044	explorer.exe	201
PID 4044 wrote to memory of 5440	4044	explorer.exe	201
PID 4044 wrote to memory of 5440	4044	explorer.exe	201
PID 4044 wrote to memory of 5472	4044	explorer.exe	202
PID 4044 wrote to memory of 5472	4044	explorer.exe	202
PID 4044 wrote to memory of 5472	4044	explorer.exe	202
PID 4044 wrote to memory of 5504	4044	explorer.exe	203
PID 4044 wrote to memory of 5504	4044	explorer.exe	203
PID 4044 wrote to memory of 5504	4044	explorer.exe	203
PID 4044 wrote to memory of 5536	4044	explorer.exe	204
PID 4044 wrote to memory of 5536	4044	explorer.exe	204
PID 4044 wrote to memory of 5536	4044	explorer.exe	204
PID 4044 wrote to memory of 5572	4044	explorer.exe	205
PID 4044 wrote to memory of 5572	4044	explorer.exe	205
PID 4044 wrote to memory of 5572	4044	explorer.exe	205
PID 4044 wrote to memory of 5604	4044	explorer.exe	206
PID 4044 wrote to memory of 5604	4044	explorer.exe	206
PID 4044 wrote to memory of 5604	4044	explorer.exe	206
PID 4044 wrote to memory of 5636	4044	explorer.exe	207
PID 4044 wrote to memory of 5636	4044	explorer.exe	207
PID 4044 wrote to memory of 5636	4044	explorer.exe	207
PID 4044 wrote to memory of 5668	4044	explorer.exe	208
PID 4044 wrote to memory of 5668	4044	explorer.exe	208
PID 4044 wrote to memory of 5668	4044	explorer.exe	208
PID 4044 wrote to memory of 5700	4044	explorer.exe	209
PID 4044 wrote to memory of 5700	4044	explorer.exe	209
PID 4044 wrote to memory of 5700	4044	explorer.exe	209
PID 4044 wrote to memory of 5736	4044	explorer.exe	210
PID 4044 wrote to memory of 5736	4044	explorer.exe	210
PID 4044 wrote to memory of 5736	4044	explorer.exe	210
PID 4044 wrote to memory of 5768	4044	explorer.exe	211
PID 4044 wrote to memory of 5768	4044	explorer.exe	211
PID 4044 wrote to memory of 5768	4044	explorer.exe	211
PID 4044 wrote to memory of 5800	4044	explorer.exe	212
PID 4044 wrote to memory of 5800	4044	explorer.exe	212
PID 4044 wrote to memory of 5800	4044	explorer.exe	212
PID 4044 wrote to memory of 5832	4044	explorer.exe	213
PID 4044 wrote to memory of 5832	4044	explorer.exe	213
PID 4044 wrote to memory of 5832	4044	explorer.exe	213
PID 4044 wrote to memory of 5864	4044	explorer.exe	214
PID 4044 wrote to memory of 5864	4044	explorer.exe	214
PID 4044 wrote to memory of 5864	4044	explorer.exe	214
PID 4044 wrote to memory of 5896	4044	explorer.exe	215
PID 4044 wrote to memory of 5896	4044	explorer.exe	215
PID 4044 wrote to memory of 5896	4044	explorer.exe	215
PID 4044 wrote to memory of 5976	4044	explorer.exe	217
PID 4044 wrote to memory of 5976	4044	explorer.exe	217
PID 4044 wrote to memory of 5976	4044	explorer.exe	217
PID 4044 wrote to memory of 6060	4044	explorer.exe	219
PID 4044 wrote to memory of 6060	4044	explorer.exe	219
PID 4044 wrote to memory of 6060	4044	explorer.exe	219
PID 4044 wrote to memory of 6096	4044	explorer.exe	220
PID 4044 wrote to memory of 6096	4044	explorer.exe	220
PID 4044 wrote to memory of 6096	4044	explorer.exe	220
PID 3972 wrote to memory of 6120	3972	spoolsv.exe	221
PID 3972 wrote to memory of 6120	3972	spoolsv.exe	221
PID 3972 wrote to memory of 6120	3972	spoolsv.exe	221
PID 3972 wrote to memory of 6120	3972	spoolsv.exe	221
PID 3972 wrote to memory of 6120	3972	spoolsv.exe	221
PID 3972 wrote to memory of 6120	3972	spoolsv.exe	221
PID 3972 wrote to memory of 6120	3972	spoolsv.exe	221
PID 3972 wrote to memory of 6120	3972	spoolsv.exe	221
PID 3972 wrote to memory of 4448	3972	spoolsv.exe	222
PID 3972 wrote to memory of 4448	3972	spoolsv.exe	222
PID 3972 wrote to memory of 4448	3972	spoolsv.exe	222
PID 3972 wrote to memory of 4448	3972	spoolsv.exe	222
PID 3972 wrote to memory of 4448	3972	spoolsv.exe	222
PID 4044 wrote to memory of 5188	4044	explorer.exe	223
PID 4044 wrote to memory of 5188	4044	explorer.exe	223
PID 4044 wrote to memory of 5188	4044	explorer.exe	223
PID 1476 wrote to memory of 5216	1476	spoolsv.exe	224
PID 1476 wrote to memory of 5216	1476	spoolsv.exe	224
PID 1476 wrote to memory of 5216	1476	spoolsv.exe	224
PID 1476 wrote to memory of 5216	1476	spoolsv.exe	224
PID 1476 wrote to memory of 5216	1476	spoolsv.exe	224
PID 1476 wrote to memory of 5216	1476	spoolsv.exe	224
PID 1476 wrote to memory of 5216	1476	spoolsv.exe	224
PID 1476 wrote to memory of 5216	1476	spoolsv.exe	224
PID 1912 wrote to memory of 5300	1912	spoolsv.exe	225
PID 1912 wrote to memory of 5300	1912	spoolsv.exe	225
PID 1912 wrote to memory of 5300	1912	spoolsv.exe	225
PID 1476 wrote to memory of 5348	1476	spoolsv.exe	226
PID 1476 wrote to memory of 5348	1476	spoolsv.exe	226
PID 1476 wrote to memory of 5348	1476	spoolsv.exe	226
PID 1912 wrote to memory of 5300	1912	spoolsv.exe	225
PID 1912 wrote to memory of 5300	1912	spoolsv.exe	225
PID 1912 wrote to memory of 5300	1912	spoolsv.exe	225
PID 1912 wrote to memory of 5300	1912	spoolsv.exe	225
PID 1912 wrote to memory of 5300	1912	spoolsv.exe	225

Suspicious behavior: EnumeratesProcesses 288 IoCs

pid	Process
2500	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe
2500	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe
4044	explorer.exe

Adds Run entry to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 2908 set thread context of 2500	2908	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe	72
PID 2908 set thread context of 2764	2908	c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe	73
PID 3856 set thread context of 4044	3856	explorer.exe	75
PID 3856 set thread context of 3340	3856	explorer.exe	76
PID 3972 set thread context of 6120	3972	spoolsv.exe	221
PID 3972 set thread context of 4448	3972	spoolsv.exe	222
PID 1476 set thread context of 5216	1476	spoolsv.exe	224
PID 1912 set thread context of 5300	1912	spoolsv.exe	225

C:\Users\Admin\AppData\Local\Temp\c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe
"C:\Users\Admin\AppData\Local\Temp\c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Adds Run entry to start application
- Suspicious use of SetThreadContext
PID:2908
- C:\Users\Admin\AppData\Local\Temp\c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe
  "C:\Users\Admin\AppData\Local\Temp\c68f64bc4262f54740d238cbeea1dbde902e66ffb95b68d6d9d27c57431ec682.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - Suspicious behavior: EnumeratesProcesses
  PID:2500
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    - Adds Run entry to start application
    - Suspicious use of SetThreadContext
    PID:3856
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      Executes dropped EXE
      Suspicious behavior: GetForegroundWindowSpam
      Modifies the visibility of hidden or system files
      Drops file in Windows directory
      Modifies Installed Components in the registry
      Suspicious use of WriteProcessMemory
      Suspicious behavior: EnumeratesProcesses
      Adds Run entry to start application
      Modifies WinLogon for persistence
      PID:4044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Adds Run entry to start application
        Suspicious use of SetThreadContext
        
        PID:3972
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        Suspicious use of SetWindowsHookEx
        Drops file in Windows directory
        
        PID:6120
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:4448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Adds Run entry to start application
        Suspicious use of SetThreadContext
        
        PID:1476
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:5216
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:5348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1912
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:5300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2204
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4248
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:64
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5144
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5176
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5240
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:6060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:6096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5188
  - - C:\Windows\SysWOW64\diskperf.exe
      "C:\Windows\SysWOW64\diskperf.exe"
      4⤵
      PID:3340
- C:\Windows\SysWOW64\diskperf.exe
  "C:\Windows\SysWOW64\diskperf.exe"
  2⤵
  PID:2764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2500-10-0x0000000003AE0000-0x0000000003AE1000-memory.dmp

Download

memory/2500-9-0x00000000032E0000-0x00000000032E1000-memory.dmp

Download

memory/2500-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2500-2-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2764-3-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2764-5-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4044-307-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-412-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-223-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-220-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-227-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-228-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-219-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-216-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-231-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-232-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-215-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-235-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-236-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-601-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-212-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-239-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-240-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-598-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-211-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-243-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-244-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-29-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-208-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-247-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-248-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-30-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-207-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-251-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-252-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-592-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-204-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-255-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-256-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-591-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-203-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-259-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-260-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-31-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-200-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-263-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-264-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-588-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-199-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-267-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-268-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-587-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-196-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-271-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-272-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-32-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-195-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-275-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-276-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-584-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-192-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-279-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-280-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-583-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-191-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-283-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-284-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-35-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-188-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-287-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-288-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-580-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-187-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-291-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-292-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-579-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-184-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-295-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-296-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-36-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-183-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-299-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-300-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-576-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-180-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-303-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-304-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-575-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-179-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-176-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-308-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-39-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-175-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-311-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-312-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-572-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-172-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-316-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-315-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-571-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-171-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-319-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-320-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-40-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-168-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-323-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-324-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-568-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-167-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-327-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-328-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-567-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-164-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-331-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-332-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-43-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-163-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-335-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-336-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-564-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-160-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-339-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-340-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-563-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-159-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-343-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-344-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-44-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-156-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-347-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-348-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-560-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-155-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-351-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-352-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-559-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-152-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-355-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-356-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-47-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-151-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-359-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-360-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-556-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-148-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-363-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-364-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-555-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-147-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-367-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-368-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-48-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-144-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-371-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-372-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-552-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-143-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-375-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-376-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-551-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-140-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-379-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-380-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-51-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-139-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-383-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-384-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-548-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-136-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-387-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-388-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-547-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-135-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-391-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-392-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-52-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-132-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-395-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-396-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-544-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-131-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-399-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-400-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-543-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-128-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-403-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-404-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-55-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-127-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-407-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-408-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-540-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-124-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-411-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-224-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-539-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-123-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-415-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-416-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-56-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-120-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-419-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-420-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-536-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-119-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-423-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-424-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-535-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-116-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-427-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-428-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-59-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-115-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-431-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-432-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-532-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-112-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-435-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-436-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-531-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-111-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-439-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-440-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-60-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-108-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-443-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-444-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-528-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-107-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-447-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-448-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-527-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-104-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-451-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-452-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-63-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-103-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-455-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-456-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-524-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-100-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-459-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-460-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-523-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-99-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-463-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-464-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-96-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-95-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-467-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-468-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-64-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-92-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-471-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-472-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-520-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-91-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-475-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-476-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-519-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-88-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-479-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-480-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-67-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-87-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-483-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-484-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-84-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-83-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-487-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-488-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-516-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-80-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-491-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-492-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-515-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-79-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-495-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-496-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-68-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-76-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-499-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-500-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-512-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-75-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-503-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-504-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-511-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-72-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-507-0x0000000003360000-0x0000000003361000-memory.dmp

Download

memory/4044-508-0x0000000003B60000-0x0000000003B61000-memory.dmp

Download

memory/4044-71-0x0000000003360000-0x0000000003361000-memory.dmp

Download