7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444

Analysis

max time kernel
131s
max time network
114s
platform
windows10_x64
resource
win10
submitted
06/07/2020, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe
Size 1.8MB
Sample200706-tyanm3kelx
SHA256 7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444
MD5 fdb25724e73ed922857c3ab8cb8ac53a
SHA1 4c36cafb2c593c07ea923d730492187aef4ca128
SHA512 2d20a9f518c06844869aba3d36608ea341420b1805aba409734a2823e9bbffbc52da1b972de539cc87460124d3f2b87014dec50fdc3b015b920da08116cc6ffc
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Adds Run entry to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Modifies the visibility of hidden or system files 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 3864 set thread context of 2448	3864	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe	67
PID 3864 set thread context of 3816	3864	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe	68
PID 3888 set thread context of 1448	3888	explorer.exe	76
PID 3888 set thread context of 1632	3888	explorer.exe	77
PID 1060 set thread context of 5932	1060	spoolsv.exe	222
PID 1060 set thread context of 5980	1060	spoolsv.exe	224

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2448	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe
2448	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
5932	spoolsv.exe
5932	spoolsv.exe

Executes dropped EXE 148 IoCs

pid	Process
3888	explorer.exe
1448	explorer.exe
1060	spoolsv.exe
1908	spoolsv.exe
2284	spoolsv.exe
2176	spoolsv.exe
3948	spoolsv.exe
2492	spoolsv.exe
1856	spoolsv.exe
2840	spoolsv.exe
3708	spoolsv.exe
3448	spoolsv.exe
3380	spoolsv.exe
3540	spoolsv.exe
3968	spoolsv.exe
3864	spoolsv.exe
3264	spoolsv.exe
3260	spoolsv.exe
3828	spoolsv.exe
864	spoolsv.exe
1948	spoolsv.exe
1352	spoolsv.exe
1144	spoolsv.exe
2708	spoolsv.exe
3020	spoolsv.exe
4020	spoolsv.exe
3752	spoolsv.exe
1648	spoolsv.exe
1848	spoolsv.exe
1916	spoolsv.exe
3040	spoolsv.exe
2728	spoolsv.exe
3704	spoolsv.exe
1492	spoolsv.exe
3148	spoolsv.exe
3916	spoolsv.exe
1408	spoolsv.exe
2348	spoolsv.exe
1108	spoolsv.exe
2524	spoolsv.exe
1816	spoolsv.exe
976	spoolsv.exe
3568	spoolsv.exe
3604	spoolsv.exe
3800	spoolsv.exe
1072	spoolsv.exe
3644	spoolsv.exe
980	spoolsv.exe
2844	spoolsv.exe
3852	spoolsv.exe
3748	spoolsv.exe
2016	spoolsv.exe
2280	spoolsv.exe
3912	spoolsv.exe
4120	spoolsv.exe
4152	spoolsv.exe
4184	spoolsv.exe
4216	spoolsv.exe
4248	spoolsv.exe
4284	spoolsv.exe
4316	spoolsv.exe
4348	spoolsv.exe
4380	spoolsv.exe
4412	spoolsv.exe
4444	spoolsv.exe
4476	spoolsv.exe
4508	spoolsv.exe
4540	spoolsv.exe
4572	spoolsv.exe
4604	spoolsv.exe
4636	spoolsv.exe
4668	spoolsv.exe
4700	spoolsv.exe
4732	spoolsv.exe
4764	spoolsv.exe
4796	spoolsv.exe
4828	spoolsv.exe
4860	spoolsv.exe
4892	spoolsv.exe
4924	spoolsv.exe
4956	spoolsv.exe
4992	spoolsv.exe
5024	spoolsv.exe
5056	spoolsv.exe
5088	spoolsv.exe
3436	spoolsv.exe
4160	spoolsv.exe
4208	spoolsv.exe
4276	spoolsv.exe
4340	spoolsv.exe
4404	spoolsv.exe
4468	spoolsv.exe
4532	spoolsv.exe
4596	spoolsv.exe
4660	spoolsv.exe
4728	spoolsv.exe
4788	spoolsv.exe
4852	spoolsv.exe
4916	spoolsv.exe
4984	spoolsv.exe
5048	spoolsv.exe
5112	spoolsv.exe
4192	spoolsv.exe
4324	spoolsv.exe
4452	spoolsv.exe
4580	spoolsv.exe
4708	spoolsv.exe
4772	spoolsv.exe
4900	spoolsv.exe
5032	spoolsv.exe
1780	spoolsv.exe
4356	spoolsv.exe
4548	spoolsv.exe
500	spoolsv.exe
5000	spoolsv.exe
3804	spoolsv.exe
4612	spoolsv.exe
4936	spoolsv.exe
4296	spoolsv.exe
3848	spoolsv.exe
4292	spoolsv.exe
5128	spoolsv.exe
5160	spoolsv.exe
5192	spoolsv.exe
5224	spoolsv.exe
5256	spoolsv.exe
5288	spoolsv.exe
5320	spoolsv.exe
5352	spoolsv.exe
5384	spoolsv.exe
5416	spoolsv.exe
5448	spoolsv.exe
5480	spoolsv.exe
5512	spoolsv.exe
5544	spoolsv.exe
5576	spoolsv.exe
5612	spoolsv.exe
5644	spoolsv.exe
5676	spoolsv.exe
5708	spoolsv.exe
5740	spoolsv.exe
5772	spoolsv.exe
5804	spoolsv.exe
5836	spoolsv.exe
5868	spoolsv.exe
5900	spoolsv.exe
5932	spoolsv.exe
5944	spoolsv.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Suspicious use of WriteProcessMemory 488 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 2448	3864	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe	67
PID 3864 wrote to memory of 2448	3864	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe	67
PID 3864 wrote to memory of 2448	3864	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe	67
PID 3864 wrote to memory of 2448	3864	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe	67
PID 3864 wrote to memory of 2448	3864	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe	67
PID 3864 wrote to memory of 2448	3864	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe	67
PID 3864 wrote to memory of 2448	3864	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe	67
PID 3864 wrote to memory of 2448	3864	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe	67
PID 3864 wrote to memory of 3816	3864	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe	68
PID 3864 wrote to memory of 3816	3864	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe	68
PID 3864 wrote to memory of 3816	3864	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe	68
PID 3864 wrote to memory of 3816	3864	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe	68
PID 3864 wrote to memory of 3816	3864	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe	68
PID 2448 wrote to memory of 3888	2448	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe	69
PID 2448 wrote to memory of 3888	2448	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe	69
PID 2448 wrote to memory of 3888	2448	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe	69
PID 3888 wrote to memory of 1448	3888	explorer.exe	76
PID 3888 wrote to memory of 1448	3888	explorer.exe	76
PID 3888 wrote to memory of 1448	3888	explorer.exe	76
PID 3888 wrote to memory of 1448	3888	explorer.exe	76
PID 3888 wrote to memory of 1448	3888	explorer.exe	76
PID 3888 wrote to memory of 1448	3888	explorer.exe	76
PID 3888 wrote to memory of 1448	3888	explorer.exe	76
PID 3888 wrote to memory of 1448	3888	explorer.exe	76
PID 3888 wrote to memory of 1632	3888	explorer.exe	77
PID 3888 wrote to memory of 1632	3888	explorer.exe	77
PID 3888 wrote to memory of 1632	3888	explorer.exe	77
PID 3888 wrote to memory of 1632	3888	explorer.exe	77
PID 3888 wrote to memory of 1632	3888	explorer.exe	77
PID 1448 wrote to memory of 1060	1448	explorer.exe	78
PID 1448 wrote to memory of 1060	1448	explorer.exe	78
PID 1448 wrote to memory of 1060	1448	explorer.exe	78
PID 1448 wrote to memory of 1908	1448	explorer.exe	79
PID 1448 wrote to memory of 1908	1448	explorer.exe	79
PID 1448 wrote to memory of 1908	1448	explorer.exe	79
PID 1448 wrote to memory of 2284	1448	explorer.exe	80
PID 1448 wrote to memory of 2284	1448	explorer.exe	80
PID 1448 wrote to memory of 2284	1448	explorer.exe	80
PID 1448 wrote to memory of 2176	1448	explorer.exe	81
PID 1448 wrote to memory of 2176	1448	explorer.exe	81
PID 1448 wrote to memory of 2176	1448	explorer.exe	81
PID 1448 wrote to memory of 3948	1448	explorer.exe	82
PID 1448 wrote to memory of 3948	1448	explorer.exe	82
PID 1448 wrote to memory of 3948	1448	explorer.exe	82
PID 1448 wrote to memory of 2492	1448	explorer.exe	83
PID 1448 wrote to memory of 2492	1448	explorer.exe	83
PID 1448 wrote to memory of 2492	1448	explorer.exe	83
PID 1448 wrote to memory of 1856	1448	explorer.exe	84
PID 1448 wrote to memory of 1856	1448	explorer.exe	84
PID 1448 wrote to memory of 1856	1448	explorer.exe	84
PID 1448 wrote to memory of 2840	1448	explorer.exe	85
PID 1448 wrote to memory of 2840	1448	explorer.exe	85
PID 1448 wrote to memory of 2840	1448	explorer.exe	85
PID 1448 wrote to memory of 3708	1448	explorer.exe	86
PID 1448 wrote to memory of 3708	1448	explorer.exe	86
PID 1448 wrote to memory of 3708	1448	explorer.exe	86
PID 1448 wrote to memory of 3448	1448	explorer.exe	87
PID 1448 wrote to memory of 3448	1448	explorer.exe	87
PID 1448 wrote to memory of 3448	1448	explorer.exe	87
PID 1448 wrote to memory of 3380	1448	explorer.exe	88
PID 1448 wrote to memory of 3380	1448	explorer.exe	88
PID 1448 wrote to memory of 3380	1448	explorer.exe	88
PID 1448 wrote to memory of 3540	1448	explorer.exe	89
PID 1448 wrote to memory of 3540	1448	explorer.exe	89
PID 1448 wrote to memory of 3540	1448	explorer.exe	89
PID 1448 wrote to memory of 3968	1448	explorer.exe	90
PID 1448 wrote to memory of 3968	1448	explorer.exe	90
PID 1448 wrote to memory of 3968	1448	explorer.exe	90
PID 1448 wrote to memory of 3864	1448	explorer.exe	91
PID 1448 wrote to memory of 3864	1448	explorer.exe	91
PID 1448 wrote to memory of 3864	1448	explorer.exe	91
PID 1448 wrote to memory of 3264	1448	explorer.exe	92
PID 1448 wrote to memory of 3264	1448	explorer.exe	92
PID 1448 wrote to memory of 3264	1448	explorer.exe	92
PID 1448 wrote to memory of 3260	1448	explorer.exe	93
PID 1448 wrote to memory of 3260	1448	explorer.exe	93
PID 1448 wrote to memory of 3260	1448	explorer.exe	93
PID 1448 wrote to memory of 3828	1448	explorer.exe	94
PID 1448 wrote to memory of 3828	1448	explorer.exe	94
PID 1448 wrote to memory of 3828	1448	explorer.exe	94
PID 1448 wrote to memory of 864	1448	explorer.exe	95
PID 1448 wrote to memory of 864	1448	explorer.exe	95
PID 1448 wrote to memory of 864	1448	explorer.exe	95
PID 1448 wrote to memory of 1948	1448	explorer.exe	96
PID 1448 wrote to memory of 1948	1448	explorer.exe	96
PID 1448 wrote to memory of 1948	1448	explorer.exe	96
PID 1448 wrote to memory of 1352	1448	explorer.exe	97
PID 1448 wrote to memory of 1352	1448	explorer.exe	97
PID 1448 wrote to memory of 1352	1448	explorer.exe	97
PID 1448 wrote to memory of 1144	1448	explorer.exe	98
PID 1448 wrote to memory of 1144	1448	explorer.exe	98
PID 1448 wrote to memory of 1144	1448	explorer.exe	98
PID 1448 wrote to memory of 2708	1448	explorer.exe	99
PID 1448 wrote to memory of 2708	1448	explorer.exe	99
PID 1448 wrote to memory of 2708	1448	explorer.exe	99
PID 1448 wrote to memory of 3020	1448	explorer.exe	100
PID 1448 wrote to memory of 3020	1448	explorer.exe	100
PID 1448 wrote to memory of 3020	1448	explorer.exe	100
PID 1448 wrote to memory of 4020	1448	explorer.exe	101
PID 1448 wrote to memory of 4020	1448	explorer.exe	101
PID 1448 wrote to memory of 4020	1448	explorer.exe	101
PID 1448 wrote to memory of 3752	1448	explorer.exe	102
PID 1448 wrote to memory of 3752	1448	explorer.exe	102
PID 1448 wrote to memory of 3752	1448	explorer.exe	102
PID 1448 wrote to memory of 1648	1448	explorer.exe	103
PID 1448 wrote to memory of 1648	1448	explorer.exe	103
PID 1448 wrote to memory of 1648	1448	explorer.exe	103
PID 1448 wrote to memory of 1848	1448	explorer.exe	104
PID 1448 wrote to memory of 1848	1448	explorer.exe	104
PID 1448 wrote to memory of 1848	1448	explorer.exe	104
PID 1448 wrote to memory of 1916	1448	explorer.exe	105
PID 1448 wrote to memory of 1916	1448	explorer.exe	105
PID 1448 wrote to memory of 1916	1448	explorer.exe	105
PID 1448 wrote to memory of 3040	1448	explorer.exe	106
PID 1448 wrote to memory of 3040	1448	explorer.exe	106
PID 1448 wrote to memory of 3040	1448	explorer.exe	106
PID 1448 wrote to memory of 2728	1448	explorer.exe	107
PID 1448 wrote to memory of 2728	1448	explorer.exe	107
PID 1448 wrote to memory of 2728	1448	explorer.exe	107
PID 1448 wrote to memory of 3704	1448	explorer.exe	108
PID 1448 wrote to memory of 3704	1448	explorer.exe	108
PID 1448 wrote to memory of 3704	1448	explorer.exe	108
PID 1448 wrote to memory of 1492	1448	explorer.exe	109
PID 1448 wrote to memory of 1492	1448	explorer.exe	109
PID 1448 wrote to memory of 1492	1448	explorer.exe	109
PID 1448 wrote to memory of 3148	1448	explorer.exe	110
PID 1448 wrote to memory of 3148	1448	explorer.exe	110
PID 1448 wrote to memory of 3148	1448	explorer.exe	110
PID 1448 wrote to memory of 3916	1448	explorer.exe	111
PID 1448 wrote to memory of 3916	1448	explorer.exe	111
PID 1448 wrote to memory of 3916	1448	explorer.exe	111
PID 1448 wrote to memory of 1408	1448	explorer.exe	112
PID 1448 wrote to memory of 1408	1448	explorer.exe	112
PID 1448 wrote to memory of 1408	1448	explorer.exe	112
PID 1448 wrote to memory of 2348	1448	explorer.exe	113
PID 1448 wrote to memory of 2348	1448	explorer.exe	113
PID 1448 wrote to memory of 2348	1448	explorer.exe	113
PID 1448 wrote to memory of 1108	1448	explorer.exe	114
PID 1448 wrote to memory of 1108	1448	explorer.exe	114
PID 1448 wrote to memory of 1108	1448	explorer.exe	114
PID 1448 wrote to memory of 2524	1448	explorer.exe	115
PID 1448 wrote to memory of 2524	1448	explorer.exe	115
PID 1448 wrote to memory of 2524	1448	explorer.exe	115
PID 1448 wrote to memory of 1816	1448	explorer.exe	116
PID 1448 wrote to memory of 1816	1448	explorer.exe	116
PID 1448 wrote to memory of 1816	1448	explorer.exe	116
PID 1448 wrote to memory of 976	1448	explorer.exe	117
PID 1448 wrote to memory of 976	1448	explorer.exe	117
PID 1448 wrote to memory of 976	1448	explorer.exe	117
PID 1448 wrote to memory of 3568	1448	explorer.exe	118
PID 1448 wrote to memory of 3568	1448	explorer.exe	118
PID 1448 wrote to memory of 3568	1448	explorer.exe	118
PID 1448 wrote to memory of 3604	1448	explorer.exe	119
PID 1448 wrote to memory of 3604	1448	explorer.exe	119
PID 1448 wrote to memory of 3604	1448	explorer.exe	119
PID 1448 wrote to memory of 3800	1448	explorer.exe	120
PID 1448 wrote to memory of 3800	1448	explorer.exe	120
PID 1448 wrote to memory of 3800	1448	explorer.exe	120
PID 1448 wrote to memory of 1072	1448	explorer.exe	121
PID 1448 wrote to memory of 1072	1448	explorer.exe	121
PID 1448 wrote to memory of 1072	1448	explorer.exe	121
PID 1448 wrote to memory of 3644	1448	explorer.exe	122
PID 1448 wrote to memory of 3644	1448	explorer.exe	122
PID 1448 wrote to memory of 3644	1448	explorer.exe	122
PID 1448 wrote to memory of 980	1448	explorer.exe	123
PID 1448 wrote to memory of 980	1448	explorer.exe	123
PID 1448 wrote to memory of 980	1448	explorer.exe	123
PID 1448 wrote to memory of 2844	1448	explorer.exe	124
PID 1448 wrote to memory of 2844	1448	explorer.exe	124
PID 1448 wrote to memory of 2844	1448	explorer.exe	124
PID 1448 wrote to memory of 3852	1448	explorer.exe	125
PID 1448 wrote to memory of 3852	1448	explorer.exe	125
PID 1448 wrote to memory of 3852	1448	explorer.exe	125
PID 1448 wrote to memory of 3748	1448	explorer.exe	126
PID 1448 wrote to memory of 3748	1448	explorer.exe	126
PID 1448 wrote to memory of 3748	1448	explorer.exe	126
PID 1448 wrote to memory of 2016	1448	explorer.exe	127
PID 1448 wrote to memory of 2016	1448	explorer.exe	127
PID 1448 wrote to memory of 2016	1448	explorer.exe	127
PID 1448 wrote to memory of 2280	1448	explorer.exe	128
PID 1448 wrote to memory of 2280	1448	explorer.exe	128
PID 1448 wrote to memory of 2280	1448	explorer.exe	128
PID 1448 wrote to memory of 3912	1448	explorer.exe	129
PID 1448 wrote to memory of 3912	1448	explorer.exe	129
PID 1448 wrote to memory of 3912	1448	explorer.exe	129
PID 1448 wrote to memory of 4120	1448	explorer.exe	130
PID 1448 wrote to memory of 4120	1448	explorer.exe	130
PID 1448 wrote to memory of 4120	1448	explorer.exe	130
PID 1448 wrote to memory of 4152	1448	explorer.exe	131
PID 1448 wrote to memory of 4152	1448	explorer.exe	131
PID 1448 wrote to memory of 4152	1448	explorer.exe	131
PID 1448 wrote to memory of 4184	1448	explorer.exe	132
PID 1448 wrote to memory of 4184	1448	explorer.exe	132
PID 1448 wrote to memory of 4184	1448	explorer.exe	132
PID 1448 wrote to memory of 4216	1448	explorer.exe	133
PID 1448 wrote to memory of 4216	1448	explorer.exe	133
PID 1448 wrote to memory of 4216	1448	explorer.exe	133
PID 1448 wrote to memory of 4248	1448	explorer.exe	134
PID 1448 wrote to memory of 4248	1448	explorer.exe	134
PID 1448 wrote to memory of 4248	1448	explorer.exe	134
PID 1448 wrote to memory of 4284	1448	explorer.exe	135
PID 1448 wrote to memory of 4284	1448	explorer.exe	135
PID 1448 wrote to memory of 4284	1448	explorer.exe	135
PID 1448 wrote to memory of 4316	1448	explorer.exe	136
PID 1448 wrote to memory of 4316	1448	explorer.exe	136
PID 1448 wrote to memory of 4316	1448	explorer.exe	136
PID 1448 wrote to memory of 4348	1448	explorer.exe	137
PID 1448 wrote to memory of 4348	1448	explorer.exe	137
PID 1448 wrote to memory of 4348	1448	explorer.exe	137
PID 1448 wrote to memory of 4380	1448	explorer.exe	138
PID 1448 wrote to memory of 4380	1448	explorer.exe	138
PID 1448 wrote to memory of 4380	1448	explorer.exe	138
PID 1448 wrote to memory of 4412	1448	explorer.exe	139
PID 1448 wrote to memory of 4412	1448	explorer.exe	139
PID 1448 wrote to memory of 4412	1448	explorer.exe	139
PID 1448 wrote to memory of 4444	1448	explorer.exe	140
PID 1448 wrote to memory of 4444	1448	explorer.exe	140
PID 1448 wrote to memory of 4444	1448	explorer.exe	140
PID 1448 wrote to memory of 4476	1448	explorer.exe	141
PID 1448 wrote to memory of 4476	1448	explorer.exe	141
PID 1448 wrote to memory of 4476	1448	explorer.exe	141
PID 1448 wrote to memory of 4508	1448	explorer.exe	142
PID 1448 wrote to memory of 4508	1448	explorer.exe	142
PID 1448 wrote to memory of 4508	1448	explorer.exe	142
PID 1448 wrote to memory of 4540	1448	explorer.exe	143
PID 1448 wrote to memory of 4540	1448	explorer.exe	143
PID 1448 wrote to memory of 4540	1448	explorer.exe	143
PID 1448 wrote to memory of 4572	1448	explorer.exe	144
PID 1448 wrote to memory of 4572	1448	explorer.exe	144
PID 1448 wrote to memory of 4572	1448	explorer.exe	144
PID 1448 wrote to memory of 4604	1448	explorer.exe	145
PID 1448 wrote to memory of 4604	1448	explorer.exe	145
PID 1448 wrote to memory of 4604	1448	explorer.exe	145
PID 1448 wrote to memory of 4636	1448	explorer.exe	146
PID 1448 wrote to memory of 4636	1448	explorer.exe	146
PID 1448 wrote to memory of 4636	1448	explorer.exe	146
PID 1448 wrote to memory of 4668	1448	explorer.exe	147
PID 1448 wrote to memory of 4668	1448	explorer.exe	147
PID 1448 wrote to memory of 4668	1448	explorer.exe	147
PID 1448 wrote to memory of 4700	1448	explorer.exe	148
PID 1448 wrote to memory of 4700	1448	explorer.exe	148
PID 1448 wrote to memory of 4700	1448	explorer.exe	148
PID 1448 wrote to memory of 4732	1448	explorer.exe	149
PID 1448 wrote to memory of 4732	1448	explorer.exe	149
PID 1448 wrote to memory of 4732	1448	explorer.exe	149
PID 1448 wrote to memory of 4764	1448	explorer.exe	150
PID 1448 wrote to memory of 4764	1448	explorer.exe	150
PID 1448 wrote to memory of 4764	1448	explorer.exe	150
PID 1448 wrote to memory of 4796	1448	explorer.exe	151
PID 1448 wrote to memory of 4796	1448	explorer.exe	151
PID 1448 wrote to memory of 4796	1448	explorer.exe	151
PID 1448 wrote to memory of 4828	1448	explorer.exe	152
PID 1448 wrote to memory of 4828	1448	explorer.exe	152
PID 1448 wrote to memory of 4828	1448	explorer.exe	152
PID 1448 wrote to memory of 4860	1448	explorer.exe	153
PID 1448 wrote to memory of 4860	1448	explorer.exe	153
PID 1448 wrote to memory of 4860	1448	explorer.exe	153
PID 1448 wrote to memory of 4892	1448	explorer.exe	154
PID 1448 wrote to memory of 4892	1448	explorer.exe	154
PID 1448 wrote to memory of 4892	1448	explorer.exe	154
PID 1448 wrote to memory of 4924	1448	explorer.exe	155
PID 1448 wrote to memory of 4924	1448	explorer.exe	155
PID 1448 wrote to memory of 4924	1448	explorer.exe	155
PID 1448 wrote to memory of 4956	1448	explorer.exe	156
PID 1448 wrote to memory of 4956	1448	explorer.exe	156
PID 1448 wrote to memory of 4956	1448	explorer.exe	156
PID 1448 wrote to memory of 4992	1448	explorer.exe	157
PID 1448 wrote to memory of 4992	1448	explorer.exe	157
PID 1448 wrote to memory of 4992	1448	explorer.exe	157
PID 1448 wrote to memory of 5024	1448	explorer.exe	158
PID 1448 wrote to memory of 5024	1448	explorer.exe	158
PID 1448 wrote to memory of 5024	1448	explorer.exe	158
PID 1448 wrote to memory of 5056	1448	explorer.exe	159
PID 1448 wrote to memory of 5056	1448	explorer.exe	159
PID 1448 wrote to memory of 5056	1448	explorer.exe	159
PID 1448 wrote to memory of 5088	1448	explorer.exe	160
PID 1448 wrote to memory of 5088	1448	explorer.exe	160
PID 1448 wrote to memory of 5088	1448	explorer.exe	160
PID 1448 wrote to memory of 3436	1448	explorer.exe	161
PID 1448 wrote to memory of 3436	1448	explorer.exe	161
PID 1448 wrote to memory of 3436	1448	explorer.exe	161
PID 1448 wrote to memory of 4160	1448	explorer.exe	162
PID 1448 wrote to memory of 4160	1448	explorer.exe	162
PID 1448 wrote to memory of 4160	1448	explorer.exe	162
PID 1448 wrote to memory of 4208	1448	explorer.exe	163
PID 1448 wrote to memory of 4208	1448	explorer.exe	163
PID 1448 wrote to memory of 4208	1448	explorer.exe	163
PID 1448 wrote to memory of 4276	1448	explorer.exe	164
PID 1448 wrote to memory of 4276	1448	explorer.exe	164
PID 1448 wrote to memory of 4276	1448	explorer.exe	164
PID 1448 wrote to memory of 4340	1448	explorer.exe	165
PID 1448 wrote to memory of 4340	1448	explorer.exe	165
PID 1448 wrote to memory of 4340	1448	explorer.exe	165
PID 1448 wrote to memory of 4404	1448	explorer.exe	166
PID 1448 wrote to memory of 4404	1448	explorer.exe	166
PID 1448 wrote to memory of 4404	1448	explorer.exe	166
PID 1448 wrote to memory of 4468	1448	explorer.exe	167
PID 1448 wrote to memory of 4468	1448	explorer.exe	167
PID 1448 wrote to memory of 4468	1448	explorer.exe	167
PID 1448 wrote to memory of 4532	1448	explorer.exe	168
PID 1448 wrote to memory of 4532	1448	explorer.exe	168
PID 1448 wrote to memory of 4532	1448	explorer.exe	168
PID 1448 wrote to memory of 4596	1448	explorer.exe	169
PID 1448 wrote to memory of 4596	1448	explorer.exe	169
PID 1448 wrote to memory of 4596	1448	explorer.exe	169
PID 1448 wrote to memory of 4660	1448	explorer.exe	170
PID 1448 wrote to memory of 4660	1448	explorer.exe	170
PID 1448 wrote to memory of 4660	1448	explorer.exe	170
PID 1448 wrote to memory of 4728	1448	explorer.exe	171
PID 1448 wrote to memory of 4728	1448	explorer.exe	171
PID 1448 wrote to memory of 4728	1448	explorer.exe	171
PID 1448 wrote to memory of 4788	1448	explorer.exe	172
PID 1448 wrote to memory of 4788	1448	explorer.exe	172
PID 1448 wrote to memory of 4788	1448	explorer.exe	172
PID 1448 wrote to memory of 4852	1448	explorer.exe	173
PID 1448 wrote to memory of 4852	1448	explorer.exe	173
PID 1448 wrote to memory of 4852	1448	explorer.exe	173
PID 1448 wrote to memory of 4916	1448	explorer.exe	174
PID 1448 wrote to memory of 4916	1448	explorer.exe	174
PID 1448 wrote to memory of 4916	1448	explorer.exe	174
PID 1448 wrote to memory of 4984	1448	explorer.exe	175
PID 1448 wrote to memory of 4984	1448	explorer.exe	175
PID 1448 wrote to memory of 4984	1448	explorer.exe	175
PID 1448 wrote to memory of 5048	1448	explorer.exe	176
PID 1448 wrote to memory of 5048	1448	explorer.exe	176
PID 1448 wrote to memory of 5048	1448	explorer.exe	176
PID 1448 wrote to memory of 5112	1448	explorer.exe	177
PID 1448 wrote to memory of 5112	1448	explorer.exe	177
PID 1448 wrote to memory of 5112	1448	explorer.exe	177
PID 1448 wrote to memory of 4192	1448	explorer.exe	178
PID 1448 wrote to memory of 4192	1448	explorer.exe	178
PID 1448 wrote to memory of 4192	1448	explorer.exe	178
PID 1448 wrote to memory of 4324	1448	explorer.exe	179
PID 1448 wrote to memory of 4324	1448	explorer.exe	179
PID 1448 wrote to memory of 4324	1448	explorer.exe	179
PID 1448 wrote to memory of 4452	1448	explorer.exe	180
PID 1448 wrote to memory of 4452	1448	explorer.exe	180
PID 1448 wrote to memory of 4452	1448	explorer.exe	180
PID 1448 wrote to memory of 4580	1448	explorer.exe	181
PID 1448 wrote to memory of 4580	1448	explorer.exe	181
PID 1448 wrote to memory of 4580	1448	explorer.exe	181
PID 1448 wrote to memory of 4708	1448	explorer.exe	182
PID 1448 wrote to memory of 4708	1448	explorer.exe	182
PID 1448 wrote to memory of 4708	1448	explorer.exe	182
PID 1448 wrote to memory of 4772	1448	explorer.exe	183
PID 1448 wrote to memory of 4772	1448	explorer.exe	183
PID 1448 wrote to memory of 4772	1448	explorer.exe	183
PID 1448 wrote to memory of 4900	1448	explorer.exe	184
PID 1448 wrote to memory of 4900	1448	explorer.exe	184
PID 1448 wrote to memory of 4900	1448	explorer.exe	184
PID 1448 wrote to memory of 5032	1448	explorer.exe	185
PID 1448 wrote to memory of 5032	1448	explorer.exe	185
PID 1448 wrote to memory of 5032	1448	explorer.exe	185
PID 1448 wrote to memory of 1780	1448	explorer.exe	186
PID 1448 wrote to memory of 1780	1448	explorer.exe	186
PID 1448 wrote to memory of 1780	1448	explorer.exe	186
PID 1448 wrote to memory of 4356	1448	explorer.exe	187
PID 1448 wrote to memory of 4356	1448	explorer.exe	187
PID 1448 wrote to memory of 4356	1448	explorer.exe	187
PID 1448 wrote to memory of 4548	1448	explorer.exe	188
PID 1448 wrote to memory of 4548	1448	explorer.exe	188
PID 1448 wrote to memory of 4548	1448	explorer.exe	188
PID 1448 wrote to memory of 500	1448	explorer.exe	189
PID 1448 wrote to memory of 500	1448	explorer.exe	189
PID 1448 wrote to memory of 500	1448	explorer.exe	189
PID 1448 wrote to memory of 5000	1448	explorer.exe	190
PID 1448 wrote to memory of 5000	1448	explorer.exe	190
PID 1448 wrote to memory of 5000	1448	explorer.exe	190
PID 1448 wrote to memory of 3804	1448	explorer.exe	191
PID 1448 wrote to memory of 3804	1448	explorer.exe	191
PID 1448 wrote to memory of 3804	1448	explorer.exe	191
PID 1448 wrote to memory of 4612	1448	explorer.exe	192
PID 1448 wrote to memory of 4612	1448	explorer.exe	192
PID 1448 wrote to memory of 4612	1448	explorer.exe	192
PID 1448 wrote to memory of 4936	1448	explorer.exe	193
PID 1448 wrote to memory of 4936	1448	explorer.exe	193
PID 1448 wrote to memory of 4936	1448	explorer.exe	193
PID 1448 wrote to memory of 4296	1448	explorer.exe	194
PID 1448 wrote to memory of 4296	1448	explorer.exe	194
PID 1448 wrote to memory of 4296	1448	explorer.exe	194
PID 1448 wrote to memory of 3848	1448	explorer.exe	195
PID 1448 wrote to memory of 3848	1448	explorer.exe	195
PID 1448 wrote to memory of 3848	1448	explorer.exe	195
PID 1448 wrote to memory of 4292	1448	explorer.exe	196
PID 1448 wrote to memory of 4292	1448	explorer.exe	196
PID 1448 wrote to memory of 4292	1448	explorer.exe	196
PID 1448 wrote to memory of 5128	1448	explorer.exe	197
PID 1448 wrote to memory of 5128	1448	explorer.exe	197
PID 1448 wrote to memory of 5128	1448	explorer.exe	197
PID 1448 wrote to memory of 5160	1448	explorer.exe	198
PID 1448 wrote to memory of 5160	1448	explorer.exe	198
PID 1448 wrote to memory of 5160	1448	explorer.exe	198
PID 1448 wrote to memory of 5192	1448	explorer.exe	199
PID 1448 wrote to memory of 5192	1448	explorer.exe	199
PID 1448 wrote to memory of 5192	1448	explorer.exe	199
PID 1448 wrote to memory of 5224	1448	explorer.exe	200
PID 1448 wrote to memory of 5224	1448	explorer.exe	200
PID 1448 wrote to memory of 5224	1448	explorer.exe	200
PID 1448 wrote to memory of 5256	1448	explorer.exe	201
PID 1448 wrote to memory of 5256	1448	explorer.exe	201
PID 1448 wrote to memory of 5256	1448	explorer.exe	201
PID 1448 wrote to memory of 5288	1448	explorer.exe	202
PID 1448 wrote to memory of 5288	1448	explorer.exe	202
PID 1448 wrote to memory of 5288	1448	explorer.exe	202
PID 1448 wrote to memory of 5320	1448	explorer.exe	203
PID 1448 wrote to memory of 5320	1448	explorer.exe	203
PID 1448 wrote to memory of 5320	1448	explorer.exe	203
PID 1448 wrote to memory of 5352	1448	explorer.exe	204
PID 1448 wrote to memory of 5352	1448	explorer.exe	204
PID 1448 wrote to memory of 5352	1448	explorer.exe	204
PID 1448 wrote to memory of 5384	1448	explorer.exe	205
PID 1448 wrote to memory of 5384	1448	explorer.exe	205
PID 1448 wrote to memory of 5384	1448	explorer.exe	205
PID 1448 wrote to memory of 5416	1448	explorer.exe	206
PID 1448 wrote to memory of 5416	1448	explorer.exe	206
PID 1448 wrote to memory of 5416	1448	explorer.exe	206
PID 1448 wrote to memory of 5448	1448	explorer.exe	207
PID 1448 wrote to memory of 5448	1448	explorer.exe	207
PID 1448 wrote to memory of 5448	1448	explorer.exe	207
PID 1448 wrote to memory of 5480	1448	explorer.exe	208
PID 1448 wrote to memory of 5480	1448	explorer.exe	208
PID 1448 wrote to memory of 5480	1448	explorer.exe	208
PID 1448 wrote to memory of 5512	1448	explorer.exe	209
PID 1448 wrote to memory of 5512	1448	explorer.exe	209
PID 1448 wrote to memory of 5512	1448	explorer.exe	209
PID 1448 wrote to memory of 5544	1448	explorer.exe	210
PID 1448 wrote to memory of 5544	1448	explorer.exe	210
PID 1448 wrote to memory of 5544	1448	explorer.exe	210
PID 1448 wrote to memory of 5576	1448	explorer.exe	211
PID 1448 wrote to memory of 5576	1448	explorer.exe	211
PID 1448 wrote to memory of 5576	1448	explorer.exe	211
PID 1448 wrote to memory of 5612	1448	explorer.exe	212
PID 1448 wrote to memory of 5612	1448	explorer.exe	212
PID 1448 wrote to memory of 5612	1448	explorer.exe	212
PID 1448 wrote to memory of 5644	1448	explorer.exe	213
PID 1448 wrote to memory of 5644	1448	explorer.exe	213
PID 1448 wrote to memory of 5644	1448	explorer.exe	213
PID 1448 wrote to memory of 5676	1448	explorer.exe	214
PID 1448 wrote to memory of 5676	1448	explorer.exe	214
PID 1448 wrote to memory of 5676	1448	explorer.exe	214
PID 1448 wrote to memory of 5708	1448	explorer.exe	215
PID 1448 wrote to memory of 5708	1448	explorer.exe	215
PID 1448 wrote to memory of 5708	1448	explorer.exe	215
PID 1448 wrote to memory of 5740	1448	explorer.exe	216
PID 1448 wrote to memory of 5740	1448	explorer.exe	216
PID 1448 wrote to memory of 5740	1448	explorer.exe	216
PID 1448 wrote to memory of 5772	1448	explorer.exe	217
PID 1448 wrote to memory of 5772	1448	explorer.exe	217
PID 1448 wrote to memory of 5772	1448	explorer.exe	217
PID 1448 wrote to memory of 5804	1448	explorer.exe	218
PID 1448 wrote to memory of 5804	1448	explorer.exe	218
PID 1448 wrote to memory of 5804	1448	explorer.exe	218
PID 1448 wrote to memory of 5836	1448	explorer.exe	219
PID 1448 wrote to memory of 5836	1448	explorer.exe	219
PID 1448 wrote to memory of 5836	1448	explorer.exe	219
PID 1448 wrote to memory of 5868	1448	explorer.exe	220
PID 1448 wrote to memory of 5868	1448	explorer.exe	220
PID 1448 wrote to memory of 5868	1448	explorer.exe	220
PID 1448 wrote to memory of 5900	1448	explorer.exe	221
PID 1448 wrote to memory of 5900	1448	explorer.exe	221
PID 1448 wrote to memory of 5900	1448	explorer.exe	221
PID 1060 wrote to memory of 5932	1060	spoolsv.exe	222
PID 1060 wrote to memory of 5932	1060	spoolsv.exe	222
PID 1060 wrote to memory of 5932	1060	spoolsv.exe	222
PID 1060 wrote to memory of 5932	1060	spoolsv.exe	222
PID 1060 wrote to memory of 5932	1060	spoolsv.exe	222
PID 1060 wrote to memory of 5932	1060	spoolsv.exe	222
PID 1060 wrote to memory of 5932	1060	spoolsv.exe	222
PID 1060 wrote to memory of 5932	1060	spoolsv.exe	222
PID 1448 wrote to memory of 5944	1448	explorer.exe	223
PID 1448 wrote to memory of 5944	1448	explorer.exe	223
PID 1448 wrote to memory of 5944	1448	explorer.exe	223
PID 1060 wrote to memory of 5980	1060	spoolsv.exe	224
PID 1060 wrote to memory of 5980	1060	spoolsv.exe	224
PID 1060 wrote to memory of 5980	1060	spoolsv.exe	224
PID 1060 wrote to memory of 5980	1060	spoolsv.exe	224
PID 1060 wrote to memory of 5980	1060	spoolsv.exe	224
PID 1908 wrote to memory of 6040	1908	spoolsv.exe	225
PID 1908 wrote to memory of 6040	1908	spoolsv.exe	225
PID 1908 wrote to memory of 6040	1908	spoolsv.exe	225
PID 1448 wrote to memory of 6048	1448	explorer.exe	226
PID 1448 wrote to memory of 6048	1448	explorer.exe	226
PID 1448 wrote to memory of 6048	1448	explorer.exe	226
PID 1908 wrote to memory of 6040	1908	spoolsv.exe	225
PID 1908 wrote to memory of 6040	1908	spoolsv.exe	225
PID 1908 wrote to memory of 6040	1908	spoolsv.exe	225
PID 1908 wrote to memory of 6040	1908	spoolsv.exe	225
PID 1908 wrote to memory of 6040	1908	spoolsv.exe	225

Suspicious behavior: EnumeratesProcesses 294 IoCs

pid	Process
2448	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe
2448	7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe
1448	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1448	explorer.exe

C:\Users\Admin\AppData\Local\Temp\7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe
"C:\Users\Admin\AppData\Local\Temp\7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe"
1⤵
- Adds Run entry to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Users\Admin\AppData\Local\Temp\7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe
  "C:\Users\Admin\AppData\Local\Temp\7c657dff35ee4d5fa54ea41d02e78f0754a245a1f6f6a8e12ba42e6fa1d70444.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - Suspicious behavior: EnumeratesProcesses
  PID:2448
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Adds Run entry to start application
    - Suspicious use of SetThreadContext
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Adds Run entry to start application
      Modifies Installed Components in the registry
      Modifies the visibility of hidden or system files
      Suspicious use of SetWindowsHookEx
      Executes dropped EXE
      Drops file in Windows directory
      Modifies WinLogon for persistence
      Suspicious use of WriteProcessMemory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      PID:1448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Adds Run entry to start application
        Suspicious use of SetThreadContext
        Executes dropped EXE
        
        PID:1060
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        Suspicious use of SetWindowsHookEx
        Drops file in Windows directory
        
        PID:5932
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:5980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1908
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:6040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2176
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1144
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4248
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5088
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:6048
  - - C:\Windows\SysWOW64\diskperf.exe
      "C:\Windows\SysWOW64\diskperf.exe"
      4⤵
      PID:1632
- C:\Windows\SysWOW64\diskperf.exe
  "C:\Windows\SysWOW64\diskperf.exe"
  2⤵
  PID:3816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1448-311-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-500-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-171-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-175-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-176-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-614-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-604-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-179-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-180-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-603-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-168-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-183-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-184-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-167-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-164-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-187-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-188-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-600-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-163-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-191-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-192-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-599-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-596-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-195-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-196-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-595-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-160-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-199-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-200-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-159-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-592-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-203-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-204-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-591-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-156-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-207-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-208-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-155-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-588-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-211-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-212-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-587-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-152-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-215-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-216-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-584-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-151-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-219-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-220-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-583-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-580-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-223-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-224-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-579-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-148-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-227-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-228-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-147-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-231-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-232-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-576-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-575-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-235-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-236-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-572-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-144-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-239-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-240-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-571-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-143-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-243-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-244-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-29-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-568-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-247-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-248-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-567-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-140-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-251-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-252-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-30-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-139-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-255-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-256-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-564-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-563-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-259-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-260-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-31-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-136-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-263-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-264-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-560-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-135-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-267-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-268-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-559-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-32-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-271-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-272-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-556-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-132-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-275-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-276-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-555-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-131-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-279-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-280-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-552-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-551-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-283-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-284-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-35-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-128-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-287-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-288-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-548-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-127-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-291-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-292-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-547-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-36-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-295-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-296-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-544-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-124-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-299-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-300-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-543-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-123-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-303-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-304-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-540-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-539-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-307-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-308-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-39-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-120-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-536-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-312-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-535-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-119-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-315-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-316-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-40-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-532-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-319-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-320-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-531-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-116-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-323-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-324-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-528-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-115-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-327-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-328-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-527-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-43-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-331-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-332-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-524-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-112-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-335-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-336-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-523-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-111-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-339-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-340-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-44-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-108-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-343-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-344-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-520-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-107-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-347-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-348-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-519-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-104-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-351-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-352-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-516-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-103-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-355-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-356-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-515-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-47-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-359-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-360-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-512-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-100-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-363-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-364-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-511-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-99-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-367-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-368-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-48-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-96-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-371-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-372-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-508-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-95-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-375-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-376-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-507-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-504-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-379-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-380-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-503-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-92-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-383-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-384-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-51-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-91-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-387-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-388-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-172-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-499-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-391-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-392-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-52-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-88-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-395-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-396-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-496-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-87-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-399-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-400-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-495-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-492-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-403-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-404-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-491-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-84-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-407-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-408-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-55-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-83-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-411-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-412-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-488-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-487-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-415-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-416-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-56-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-80-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-419-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-420-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-484-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-79-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-423-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-424-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-483-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-480-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-427-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-428-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-479-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-76-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-431-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-432-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-59-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-75-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-435-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-436-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-476-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-475-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-439-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-440-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-60-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-72-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-443-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-444-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-472-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-71-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-447-0x0000000003300000-0x0000000003301000-memory.dmp

Download

memory/1448-448-0x0000000003B00000-0x0000000003B01000-memory.dmp

Download

memory/1448-471-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-63-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-451-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-452-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-468-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-68-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-455-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-456-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-467-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-67-0x00000000032F0000-0x00000000032F1000-memory.dmp

Download

memory/1448-459-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/1448-460-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-64-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Download

memory/1448-464-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/1448-463-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/2448-10-0x0000000003B10000-0x0000000003B11000-memory.dmp

Download

memory/2448-2-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2448-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2448-9-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/3816-6-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3816-3-0x0000000000400000-0x0000000000412000-memory.dmp

Download