Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
04-05-2021 20:50
Static task
static1
Behavioral task
behavioral1
Sample
509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe
Resource
win10v20210408
General
-
Target
509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe
-
Size
1.8MB
-
MD5
c751650a93ae7535b12bd544e878cb92
-
SHA1
0b73c8c183250ea62d5c076a3740dd4ba3987fe6
-
SHA256
509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647
-
SHA512
cd840ea9c8000e24d42f53077acf44c595578c3113efe23ef1e6b0a75e98d36fc9c521589225cd24fca91e9a8bde1280106f47901b3b2db3aa78ec164cd6cb40
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 64 IoCs
Processes:
resource yara_rule \Windows\system\explorer.exe warzonerat \Windows\system\explorer.exe warzonerat C:\Windows\system\explorer.exe warzonerat \??\c:\windows\system\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe warzonerat C:\Users\Admin\AppData\Local\Temp\Disk.sys warzonerat C:\Windows\system\explorer.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 368 explorer.exe 1552 explorer.exe 1044 spoolsv.exe 1152 spoolsv.exe 328 spoolsv.exe 436 spoolsv.exe 1428 spoolsv.exe 2012 spoolsv.exe 828 spoolsv.exe 1320 spoolsv.exe 912 spoolsv.exe 1340 spoolsv.exe 1540 spoolsv.exe 520 spoolsv.exe 1648 spoolsv.exe 1740 spoolsv.exe 1512 spoolsv.exe 1264 spoolsv.exe 860 spoolsv.exe 1880 spoolsv.exe 1600 spoolsv.exe 1248 spoolsv.exe 1052 spoolsv.exe 1028 spoolsv.exe 1888 spoolsv.exe 1828 spoolsv.exe 1328 spoolsv.exe 1192 spoolsv.exe 1260 spoolsv.exe 1588 spoolsv.exe 2024 spoolsv.exe 1288 spoolsv.exe 920 spoolsv.exe 676 spoolsv.exe 940 spoolsv.exe 1800 spoolsv.exe 560 spoolsv.exe 2000 spoolsv.exe 1344 spoolsv.exe 1972 spoolsv.exe 540 spoolsv.exe 1112 spoolsv.exe 1144 spoolsv.exe 1580 spoolsv.exe 1652 spoolsv.exe 972 spoolsv.exe 864 spoolsv.exe 1572 spoolsv.exe 1268 spoolsv.exe 2004 spoolsv.exe 1616 spoolsv.exe 1620 spoolsv.exe 1156 spoolsv.exe 764 spoolsv.exe 1312 spoolsv.exe 1792 spoolsv.exe 1488 spoolsv.exe 1080 spoolsv.exe 1032 spoolsv.exe 632 spoolsv.exe 932 spoolsv.exe 1532 spoolsv.exe 1136 spoolsv.exe 1980 spoolsv.exe -
Modifies Installed Components in the registry 2 TTPs
-
Loads dropped DLL 64 IoCs
Processes:
509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exeexplorer.exepid process 360 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe 360 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe -
Adds Run key to start application 2 TTPs 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 2004 set thread context of 360 2004 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe PID 2004 set thread context of 1084 2004 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe diskperf.exe PID 368 set thread context of 1552 368 explorer.exe explorer.exe PID 368 set thread context of 1836 368 explorer.exe diskperf.exe PID 1044 set thread context of 3324 1044 spoolsv.exe spoolsv.exe PID 1044 set thread context of 3332 1044 spoolsv.exe diskperf.exe PID 1152 set thread context of 3388 1152 spoolsv.exe spoolsv.exe PID 1152 set thread context of 3396 1152 spoolsv.exe diskperf.exe PID 328 set thread context of 3424 328 spoolsv.exe spoolsv.exe PID 328 set thread context of 3432 328 spoolsv.exe diskperf.exe PID 436 set thread context of 3456 436 spoolsv.exe spoolsv.exe PID 436 set thread context of 3464 436 spoolsv.exe diskperf.exe PID 1428 set thread context of 3492 1428 spoolsv.exe spoolsv.exe PID 1428 set thread context of 3500 1428 spoolsv.exe diskperf.exe PID 2012 set thread context of 3528 2012 spoolsv.exe spoolsv.exe PID 2012 set thread context of 3536 2012 spoolsv.exe diskperf.exe PID 828 set thread context of 3568 828 spoolsv.exe spoolsv.exe PID 828 set thread context of 3576 828 spoolsv.exe diskperf.exe PID 1320 set thread context of 3604 1320 spoolsv.exe spoolsv.exe PID 1320 set thread context of 3612 1320 spoolsv.exe diskperf.exe PID 912 set thread context of 3640 912 spoolsv.exe spoolsv.exe PID 912 set thread context of 3648 912 spoolsv.exe diskperf.exe PID 1340 set thread context of 3676 1340 spoolsv.exe spoolsv.exe PID 1340 set thread context of 3684 1340 spoolsv.exe diskperf.exe PID 1540 set thread context of 3712 1540 spoolsv.exe spoolsv.exe PID 1540 set thread context of 3720 1540 spoolsv.exe diskperf.exe PID 520 set thread context of 3748 520 spoolsv.exe spoolsv.exe PID 520 set thread context of 3756 520 spoolsv.exe diskperf.exe PID 1648 set thread context of 3780 1648 spoolsv.exe spoolsv.exe PID 1648 set thread context of 3788 1648 spoolsv.exe diskperf.exe PID 1740 set thread context of 3808 1740 spoolsv.exe spoolsv.exe PID 1740 set thread context of 3816 1740 spoolsv.exe diskperf.exe PID 1512 set thread context of 3836 1512 spoolsv.exe spoolsv.exe PID 1512 set thread context of 3844 1512 spoolsv.exe diskperf.exe PID 1264 set thread context of 3864 1264 spoolsv.exe spoolsv.exe PID 1264 set thread context of 3872 1264 spoolsv.exe diskperf.exe PID 860 set thread context of 3892 860 spoolsv.exe spoolsv.exe PID 860 set thread context of 3900 860 spoolsv.exe diskperf.exe PID 1880 set thread context of 3920 1880 spoolsv.exe spoolsv.exe PID 1880 set thread context of 3928 1880 spoolsv.exe diskperf.exe PID 1600 set thread context of 3948 1600 spoolsv.exe spoolsv.exe PID 1600 set thread context of 3956 1600 spoolsv.exe diskperf.exe PID 1248 set thread context of 3984 1248 spoolsv.exe spoolsv.exe PID 1248 set thread context of 4004 1248 spoolsv.exe diskperf.exe PID 1052 set thread context of 4012 1052 spoolsv.exe spoolsv.exe PID 1052 set thread context of 4024 1052 spoolsv.exe diskperf.exe PID 1028 set thread context of 4032 1028 spoolsv.exe spoolsv.exe PID 1028 set thread context of 4040 1028 spoolsv.exe diskperf.exe PID 1888 set thread context of 4048 1888 spoolsv.exe spoolsv.exe PID 1828 set thread context of 4056 1828 spoolsv.exe spoolsv.exe PID 1888 set thread context of 4076 1888 spoolsv.exe diskperf.exe PID 1328 set thread context of 4092 1328 spoolsv.exe spoolsv.exe PID 1828 set thread context of 4084 1828 spoolsv.exe diskperf.exe PID 1328 set thread context of 456 1328 spoolsv.exe diskperf.exe PID 1192 set thread context of 3356 1192 spoolsv.exe spoolsv.exe PID 1192 set thread context of 3352 1192 spoolsv.exe diskperf.exe PID 1260 set thread context of 656 1260 spoolsv.exe spoolsv.exe PID 1588 set thread context of 3440 1588 spoolsv.exe spoolsv.exe PID 1260 set thread context of 1752 1260 spoolsv.exe diskperf.exe PID 1588 set thread context of 1720 1588 spoolsv.exe diskperf.exe PID 2024 set thread context of 3484 2024 spoolsv.exe spoolsv.exe PID 1288 set thread context of 3460 1288 spoolsv.exe spoolsv.exe PID 1288 set thread context of 3524 1288 spoolsv.exe diskperf.exe PID 2024 set thread context of 3520 2024 spoolsv.exe diskperf.exe -
Drops file in Windows directory 4 IoCs
Processes:
explorer.exespoolsv.exe509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exedescription ioc process File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exeexplorer.exepid process 360 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1552 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 360 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe 360 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 3324 spoolsv.exe 3324 spoolsv.exe 3388 spoolsv.exe 3388 spoolsv.exe 3424 spoolsv.exe 3424 spoolsv.exe 3456 spoolsv.exe 3456 spoolsv.exe 3492 spoolsv.exe 3492 spoolsv.exe 3528 spoolsv.exe 3528 spoolsv.exe 3568 spoolsv.exe 3568 spoolsv.exe 3604 spoolsv.exe 3604 spoolsv.exe 3640 spoolsv.exe 3640 spoolsv.exe 3676 spoolsv.exe 3676 spoolsv.exe 3712 spoolsv.exe 3712 spoolsv.exe 3748 spoolsv.exe 3748 spoolsv.exe 3780 spoolsv.exe 3780 spoolsv.exe 3808 spoolsv.exe 3808 spoolsv.exe 3836 spoolsv.exe 3836 spoolsv.exe 3864 spoolsv.exe 3864 spoolsv.exe 3892 spoolsv.exe 3892 spoolsv.exe 3920 spoolsv.exe 3920 spoolsv.exe 3948 spoolsv.exe 3948 spoolsv.exe 3984 spoolsv.exe 3984 spoolsv.exe 4012 spoolsv.exe 4012 spoolsv.exe 4032 spoolsv.exe 4032 spoolsv.exe 4048 spoolsv.exe 4048 spoolsv.exe 4056 spoolsv.exe 4056 spoolsv.exe 4092 spoolsv.exe 4092 spoolsv.exe 3356 spoolsv.exe 3356 spoolsv.exe 656 spoolsv.exe 656 spoolsv.exe 3440 spoolsv.exe 3440 spoolsv.exe 3484 spoolsv.exe 3460 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exeexplorer.exeexplorer.exedescription pid process target process PID 2004 wrote to memory of 360 2004 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe PID 2004 wrote to memory of 360 2004 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe PID 2004 wrote to memory of 360 2004 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe PID 2004 wrote to memory of 360 2004 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe PID 2004 wrote to memory of 360 2004 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe PID 2004 wrote to memory of 360 2004 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe PID 2004 wrote to memory of 360 2004 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe PID 2004 wrote to memory of 360 2004 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe PID 2004 wrote to memory of 360 2004 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe PID 2004 wrote to memory of 1084 2004 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe diskperf.exe PID 2004 wrote to memory of 1084 2004 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe diskperf.exe PID 2004 wrote to memory of 1084 2004 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe diskperf.exe PID 2004 wrote to memory of 1084 2004 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe diskperf.exe PID 2004 wrote to memory of 1084 2004 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe diskperf.exe PID 2004 wrote to memory of 1084 2004 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe diskperf.exe PID 360 wrote to memory of 368 360 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe explorer.exe PID 360 wrote to memory of 368 360 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe explorer.exe PID 360 wrote to memory of 368 360 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe explorer.exe PID 360 wrote to memory of 368 360 509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe explorer.exe PID 368 wrote to memory of 1552 368 explorer.exe explorer.exe PID 368 wrote to memory of 1552 368 explorer.exe explorer.exe PID 368 wrote to memory of 1552 368 explorer.exe explorer.exe PID 368 wrote to memory of 1552 368 explorer.exe explorer.exe PID 368 wrote to memory of 1552 368 explorer.exe explorer.exe PID 368 wrote to memory of 1552 368 explorer.exe explorer.exe PID 368 wrote to memory of 1552 368 explorer.exe explorer.exe PID 368 wrote to memory of 1552 368 explorer.exe explorer.exe PID 368 wrote to memory of 1552 368 explorer.exe explorer.exe PID 368 wrote to memory of 1836 368 explorer.exe diskperf.exe PID 368 wrote to memory of 1836 368 explorer.exe diskperf.exe PID 368 wrote to memory of 1836 368 explorer.exe diskperf.exe PID 368 wrote to memory of 1836 368 explorer.exe diskperf.exe PID 368 wrote to memory of 1836 368 explorer.exe diskperf.exe PID 368 wrote to memory of 1836 368 explorer.exe diskperf.exe PID 1552 wrote to memory of 1044 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 1044 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 1044 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 1044 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 1152 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 1152 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 1152 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 1152 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 328 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 328 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 328 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 328 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 436 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 436 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 436 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 436 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 1428 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 1428 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 1428 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 1428 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 2012 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 2012 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 2012 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 2012 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 828 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 828 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 828 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 828 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 1320 1552 explorer.exe spoolsv.exe PID 1552 wrote to memory of 1320 1552 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe"C:\Users\Admin\AppData\Local\Temp\509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe"C:\Users\Admin\AppData\Local\Temp\509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Adds Run key to start application
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"4⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Chrome\StikyNot.exeMD5
c751650a93ae7535b12bd544e878cb92
SHA10b73c8c183250ea62d5c076a3740dd4ba3987fe6
SHA256509fb9cf9464493c4f2e1ee6479f8e7f92fa6f2ac53eb0ae4490dc7b94576647
SHA512cd840ea9c8000e24d42f53077acf44c595578c3113efe23ef1e6b0a75e98d36fc9c521589225cd24fca91e9a8bde1280106f47901b3b2db3aa78ec164cd6cb40
-
C:\Users\Admin\AppData\Local\Temp\Disk.sysMD5
2f8e55a282d0327078e12f2746470a40
SHA1192e108af7474ea602429e93c0fce7947c0ede7b
SHA2567293da0005aea59e0904f6eb665d5337c4a231970a0c940a74ea2eb381d7036c
SHA512ebd67526bd166e8add958b612650497981aecf6aafbb93c6a79397b71e6264c2da7505d6b9bc193451df042a328e4a277c0354c2bb5b2db4681e8b39268e7843
-
C:\Windows\system\explorer.exeMD5
2f8e55a282d0327078e12f2746470a40
SHA1192e108af7474ea602429e93c0fce7947c0ede7b
SHA2567293da0005aea59e0904f6eb665d5337c4a231970a0c940a74ea2eb381d7036c
SHA512ebd67526bd166e8add958b612650497981aecf6aafbb93c6a79397b71e6264c2da7505d6b9bc193451df042a328e4a277c0354c2bb5b2db4681e8b39268e7843
-
C:\Windows\system\explorer.exeMD5
2f8e55a282d0327078e12f2746470a40
SHA1192e108af7474ea602429e93c0fce7947c0ede7b
SHA2567293da0005aea59e0904f6eb665d5337c4a231970a0c940a74ea2eb381d7036c
SHA512ebd67526bd166e8add958b612650497981aecf6aafbb93c6a79397b71e6264c2da7505d6b9bc193451df042a328e4a277c0354c2bb5b2db4681e8b39268e7843
-
C:\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
C:\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
C:\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
C:\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
C:\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
C:\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
C:\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
C:\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
C:\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
C:\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
C:\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
C:\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
C:\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
C:\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
C:\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
C:\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
C:\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
C:\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
C:\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\??\c:\windows\system\explorer.exeMD5
2f8e55a282d0327078e12f2746470a40
SHA1192e108af7474ea602429e93c0fce7947c0ede7b
SHA2567293da0005aea59e0904f6eb665d5337c4a231970a0c940a74ea2eb381d7036c
SHA512ebd67526bd166e8add958b612650497981aecf6aafbb93c6a79397b71e6264c2da7505d6b9bc193451df042a328e4a277c0354c2bb5b2db4681e8b39268e7843
-
\Windows\system\explorer.exeMD5
2f8e55a282d0327078e12f2746470a40
SHA1192e108af7474ea602429e93c0fce7947c0ede7b
SHA2567293da0005aea59e0904f6eb665d5337c4a231970a0c940a74ea2eb381d7036c
SHA512ebd67526bd166e8add958b612650497981aecf6aafbb93c6a79397b71e6264c2da7505d6b9bc193451df042a328e4a277c0354c2bb5b2db4681e8b39268e7843
-
\Windows\system\explorer.exeMD5
2f8e55a282d0327078e12f2746470a40
SHA1192e108af7474ea602429e93c0fce7947c0ede7b
SHA2567293da0005aea59e0904f6eb665d5337c4a231970a0c940a74ea2eb381d7036c
SHA512ebd67526bd166e8add958b612650497981aecf6aafbb93c6a79397b71e6264c2da7505d6b9bc193451df042a328e4a277c0354c2bb5b2db4681e8b39268e7843
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
\Windows\system\spoolsv.exeMD5
5a8ab693534f993748d95040e500c98e
SHA119ca65ffd17c095df65d7c5b00e930d65ddb2263
SHA2563c0b99e71e4d0068e35a304694c799f1afc41cc2dc63ef2e6639e378eb823489
SHA5121cd4e2ab62dc7cccd5b65490970d07e36caee94e6112ed72f0a5e8245a7d448ce7361600a03005437cbbd9d946d818ff4fd91cd652cbf05c23fac3baa0eeafc9
-
memory/328-107-0x0000000000000000-mapping.dmp
-
memory/360-62-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/360-75-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/360-63-0x0000000000403670-mapping.dmp
-
memory/368-73-0x0000000000000000-mapping.dmp
-
memory/368-78-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/436-127-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/436-113-0x0000000000000000-mapping.dmp
-
memory/520-175-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/520-161-0x0000000000000000-mapping.dmp
-
memory/540-281-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/540-265-0x0000000000000000-mapping.dmp
-
memory/560-250-0x0000000000000000-mapping.dmp
-
memory/632-310-0x0000000000000000-mapping.dmp
-
memory/676-244-0x0000000000000000-mapping.dmp
-
memory/676-258-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/764-304-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/764-296-0x0000000000000000-mapping.dmp
-
memory/828-132-0x0000000000000000-mapping.dmp
-
memory/828-142-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/860-195-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/860-190-0x0000000000000000-mapping.dmp
-
memory/864-277-0x0000000000000000-mapping.dmp
-
memory/912-157-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/912-143-0x0000000000000000-mapping.dmp
-
memory/920-234-0x0000000000000000-mapping.dmp
-
memory/932-311-0x0000000000000000-mapping.dmp
-
memory/940-246-0x0000000000000000-mapping.dmp
-
memory/972-275-0x0000000000000000-mapping.dmp
-
memory/972-286-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1028-219-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1028-211-0x0000000000000000-mapping.dmp
-
memory/1032-315-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1032-309-0x0000000000000000-mapping.dmp
-
memory/1044-99-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1044-94-0x0000000000000000-mapping.dmp
-
memory/1052-218-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1052-209-0x0000000000000000-mapping.dmp
-
memory/1080-308-0x0000000000000000-mapping.dmp
-
memory/1084-77-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1084-65-0x0000000000411000-mapping.dmp
-
memory/1084-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1112-267-0x0000000000000000-mapping.dmp
-
memory/1144-269-0x0000000000000000-mapping.dmp
-
memory/1144-283-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1152-102-0x0000000000000000-mapping.dmp
-
memory/1152-110-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1156-303-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1156-295-0x0000000000000000-mapping.dmp
-
memory/1192-224-0x0000000000000000-mapping.dmp
-
memory/1192-239-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1248-217-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/1248-207-0x0000000000000000-mapping.dmp
-
memory/1260-226-0x0000000000000000-mapping.dmp
-
memory/1264-185-0x0000000000000000-mapping.dmp
-
memory/1268-289-0x0000000000000000-mapping.dmp
-
memory/1288-232-0x0000000000000000-mapping.dmp
-
memory/1312-297-0x0000000000000000-mapping.dmp
-
memory/1320-137-0x0000000000000000-mapping.dmp
-
memory/1320-144-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1328-222-0x0000000000000000-mapping.dmp
-
memory/1340-158-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1340-149-0x0000000000000000-mapping.dmp
-
memory/1344-263-0x0000000000360000-0x0000000000361000-memory.dmpFilesize
4KB
-
memory/1344-254-0x0000000000000000-mapping.dmp
-
memory/1428-129-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1428-118-0x0000000000000000-mapping.dmp
-
memory/1488-307-0x0000000000000000-mapping.dmp
-
memory/1488-312-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1512-180-0x0000000000000000-mapping.dmp
-
memory/1540-154-0x0000000000000000-mapping.dmp
-
memory/1540-162-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1552-81-0x0000000000403670-mapping.dmp
-
memory/1572-288-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1572-279-0x0000000000000000-mapping.dmp
-
memory/1580-271-0x0000000000000000-mapping.dmp
-
memory/1588-228-0x0000000000000000-mapping.dmp
-
memory/1600-204-0x0000000000000000-mapping.dmp
-
memory/1600-215-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1616-301-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1616-293-0x0000000000000000-mapping.dmp
-
memory/1620-302-0x0000000000370000-0x0000000000371000-memory.dmpFilesize
4KB
-
memory/1620-294-0x0000000000000000-mapping.dmp
-
memory/1648-167-0x0000000000000000-mapping.dmp
-
memory/1652-273-0x0000000000000000-mapping.dmp
-
memory/1740-177-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1740-172-0x0000000000000000-mapping.dmp
-
memory/1792-298-0x0000000000000000-mapping.dmp
-
memory/1800-248-0x0000000000000000-mapping.dmp
-
memory/1800-260-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1828-220-0x0000000000000000-mapping.dmp
-
memory/1828-235-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1836-87-0x0000000000411000-mapping.dmp
-
memory/1880-201-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1880-198-0x0000000000000000-mapping.dmp
-
memory/1888-216-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1888-213-0x0000000000000000-mapping.dmp
-
memory/1972-256-0x0000000000000000-mapping.dmp
-
memory/2000-262-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2000-252-0x0000000000000000-mapping.dmp
-
memory/2004-291-0x0000000000000000-mapping.dmp
-
memory/2004-61-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2004-60-0x0000000075B31000-0x0000000075B33000-memory.dmpFilesize
8KB
-
memory/2012-123-0x0000000000000000-mapping.dmp
-
memory/2012-128-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2024-230-0x0000000000000000-mapping.dmp
-
memory/2024-242-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB