Analysis
-
max time kernel
151s -
max time network
110s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
04-05-2021 20:49
Static task
static1
Behavioral task
behavioral1
Sample
f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe
Resource
win10v20210410
General
-
Target
f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe
-
Size
1.8MB
-
MD5
c5b5e7134d28f77190b35cd98c2779ba
-
SHA1
df6538b2f1527afe8ff473387de959543ba02253
-
SHA256
f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191
-
SHA512
5a6e3dc41a15b658ed849d8ab18ae07b0d650f5263485ce78ae46bc1f81ef893c54bb4da4cf451e7d189e9881de240722e29cff19144e6ac7d6d7cdb6fe418c0
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 64 IoCs
Processes:
resource yara_rule \Windows\system\explorer.exe warzonerat C:\Windows\system\explorer.exe warzonerat \Windows\system\explorer.exe warzonerat \??\c:\windows\system\explorer.exe warzonerat C:\Windows\system\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe warzonerat C:\Users\Admin\AppData\Local\Temp\Disk.sys warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat \Windows\system\spoolsv.exe warzonerat C:\Windows\system\spoolsv.exe warzonerat -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 768 explorer.exe 1348 explorer.exe 1052 spoolsv.exe 1964 spoolsv.exe 956 spoolsv.exe 800 spoolsv.exe 1612 spoolsv.exe 532 spoolsv.exe 2008 spoolsv.exe 2024 spoolsv.exe 1680 spoolsv.exe 1640 spoolsv.exe 752 spoolsv.exe 1544 spoolsv.exe 728 spoolsv.exe 1568 spoolsv.exe 1660 spoolsv.exe 1924 spoolsv.exe 1540 spoolsv.exe 1912 spoolsv.exe 1176 spoolsv.exe 672 spoolsv.exe 1688 spoolsv.exe 1196 spoolsv.exe 1704 spoolsv.exe 2012 spoolsv.exe 840 spoolsv.exe 1100 spoolsv.exe 1632 spoolsv.exe 2000 spoolsv.exe 952 spoolsv.exe 948 spoolsv.exe 272 spoolsv.exe 536 spoolsv.exe 432 spoolsv.exe 1476 spoolsv.exe 1824 spoolsv.exe 1524 spoolsv.exe 1136 spoolsv.exe 1560 spoolsv.exe 1216 spoolsv.exe 1932 spoolsv.exe 284 spoolsv.exe 1184 spoolsv.exe 1648 spoolsv.exe 1596 spoolsv.exe 1256 spoolsv.exe 1668 spoolsv.exe 1636 spoolsv.exe 1276 spoolsv.exe 968 spoolsv.exe 1556 spoolsv.exe 1172 spoolsv.exe 1948 spoolsv.exe 1368 spoolsv.exe 1536 spoolsv.exe 768 spoolsv.exe 1068 spoolsv.exe 1752 spoolsv.exe 788 spoolsv.exe 1852 spoolsv.exe 2020 spoolsv.exe 1060 spoolsv.exe 1600 spoolsv.exe -
Modifies Installed Components in the registry 2 TTPs
-
Loads dropped DLL 64 IoCs
Processes:
f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exeexplorer.exepid process 1576 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe 1576 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe -
Adds Run key to start application 2 TTPs 34 IoCs
Processes:
f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe" spoolsv.exe -
Suspicious use of SetThreadContext 61 IoCs
Processes:
f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exedescription pid process target process PID 1084 set thread context of 1576 1084 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe PID 1084 set thread context of 1532 1084 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe diskperf.exe PID 768 set thread context of 1348 768 explorer.exe explorer.exe PID 768 set thread context of 1472 768 explorer.exe diskperf.exe PID 1052 set thread context of 3188 1052 spoolsv.exe spoolsv.exe PID 1052 set thread context of 3196 1052 spoolsv.exe diskperf.exe PID 1964 set thread context of 3240 1964 spoolsv.exe spoolsv.exe PID 1964 set thread context of 3248 1964 spoolsv.exe diskperf.exe PID 956 set thread context of 3272 956 spoolsv.exe spoolsv.exe PID 956 set thread context of 3280 956 spoolsv.exe diskperf.exe PID 800 set thread context of 3308 800 spoolsv.exe spoolsv.exe PID 800 set thread context of 3316 800 spoolsv.exe diskperf.exe PID 1612 set thread context of 3344 1612 spoolsv.exe spoolsv.exe PID 1612 set thread context of 3352 1612 spoolsv.exe diskperf.exe PID 532 set thread context of 3380 532 spoolsv.exe spoolsv.exe PID 532 set thread context of 3388 532 spoolsv.exe diskperf.exe PID 2008 set thread context of 3412 2008 spoolsv.exe spoolsv.exe PID 2008 set thread context of 3420 2008 spoolsv.exe diskperf.exe PID 2024 set thread context of 3448 2024 spoolsv.exe spoolsv.exe PID 2024 set thread context of 3456 2024 spoolsv.exe diskperf.exe PID 1680 set thread context of 3488 1680 spoolsv.exe spoolsv.exe PID 1680 set thread context of 3496 1680 spoolsv.exe diskperf.exe PID 1640 set thread context of 3524 1640 spoolsv.exe spoolsv.exe PID 1640 set thread context of 3532 1640 spoolsv.exe diskperf.exe PID 752 set thread context of 3552 752 spoolsv.exe spoolsv.exe PID 752 set thread context of 3560 752 spoolsv.exe diskperf.exe PID 1544 set thread context of 3580 1544 spoolsv.exe spoolsv.exe PID 1544 set thread context of 3588 1544 spoolsv.exe diskperf.exe PID 728 set thread context of 3616 728 spoolsv.exe spoolsv.exe PID 728 set thread context of 3624 728 spoolsv.exe diskperf.exe PID 1568 set thread context of 3652 1568 spoolsv.exe spoolsv.exe PID 1568 set thread context of 3660 1568 spoolsv.exe diskperf.exe PID 1660 set thread context of 3688 1660 spoolsv.exe spoolsv.exe PID 1660 set thread context of 3696 1660 spoolsv.exe diskperf.exe PID 1924 set thread context of 3724 1924 spoolsv.exe spoolsv.exe PID 1924 set thread context of 3744 1924 spoolsv.exe diskperf.exe PID 1540 set thread context of 3752 1540 spoolsv.exe spoolsv.exe PID 1540 set thread context of 3760 1540 spoolsv.exe diskperf.exe PID 1912 set thread context of 3784 1912 spoolsv.exe spoolsv.exe PID 1912 set thread context of 3792 1912 spoolsv.exe diskperf.exe PID 1176 set thread context of 3812 1176 spoolsv.exe spoolsv.exe PID 1176 set thread context of 3820 1176 spoolsv.exe diskperf.exe PID 672 set thread context of 3848 672 spoolsv.exe spoolsv.exe PID 672 set thread context of 3856 672 spoolsv.exe diskperf.exe PID 1688 set thread context of 3864 1688 spoolsv.exe spoolsv.exe PID 1688 set thread context of 3884 1688 spoolsv.exe diskperf.exe PID 1196 set thread context of 3896 1196 spoolsv.exe spoolsv.exe PID 1196 set thread context of 3904 1196 spoolsv.exe diskperf.exe PID 1704 set thread context of 3912 1704 spoolsv.exe spoolsv.exe PID 1704 set thread context of 3920 1704 spoolsv.exe diskperf.exe PID 2012 set thread context of 3928 2012 spoolsv.exe spoolsv.exe PID 2012 set thread context of 3936 2012 spoolsv.exe diskperf.exe PID 840 set thread context of 3960 840 spoolsv.exe spoolsv.exe PID 1100 set thread context of 3968 1100 spoolsv.exe spoolsv.exe PID 840 set thread context of 3976 840 spoolsv.exe diskperf.exe PID 1100 set thread context of 3996 1100 spoolsv.exe diskperf.exe PID 1632 set thread context of 4004 1632 spoolsv.exe spoolsv.exe PID 1632 set thread context of 4012 1632 spoolsv.exe diskperf.exe PID 2000 set thread context of 4020 2000 spoolsv.exe spoolsv.exe PID 2000 set thread context of 4028 2000 spoolsv.exe diskperf.exe PID 952 set thread context of 4036 952 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 4 IoCs
Processes:
f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exeexplorer.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\system\explorer.exe f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exeexplorer.exepid process 1576 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1348 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 1576 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe 1576 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 1348 explorer.exe 3188 spoolsv.exe 3188 spoolsv.exe 3240 spoolsv.exe 3240 spoolsv.exe 3272 spoolsv.exe 3272 spoolsv.exe 3308 spoolsv.exe 3308 spoolsv.exe 3344 spoolsv.exe 3344 spoolsv.exe 3380 spoolsv.exe 3380 spoolsv.exe 3412 spoolsv.exe 3412 spoolsv.exe 3448 spoolsv.exe 3448 spoolsv.exe 3488 spoolsv.exe 3488 spoolsv.exe 3524 spoolsv.exe 3524 spoolsv.exe 3552 spoolsv.exe 3552 spoolsv.exe 3580 spoolsv.exe 3580 spoolsv.exe 3616 spoolsv.exe 3616 spoolsv.exe 3652 spoolsv.exe 3652 spoolsv.exe 3688 spoolsv.exe 3688 spoolsv.exe 3724 spoolsv.exe 3724 spoolsv.exe 3752 spoolsv.exe 3752 spoolsv.exe 3784 spoolsv.exe 3784 spoolsv.exe 3812 spoolsv.exe 3812 spoolsv.exe 3848 spoolsv.exe 3848 spoolsv.exe 3864 spoolsv.exe 3864 spoolsv.exe 3896 spoolsv.exe 3896 spoolsv.exe 3912 spoolsv.exe 3912 spoolsv.exe 3928 spoolsv.exe 3928 spoolsv.exe 3960 spoolsv.exe 3968 spoolsv.exe 3960 spoolsv.exe 4004 spoolsv.exe 3968 spoolsv.exe 4004 spoolsv.exe 4020 spoolsv.exe 4036 spoolsv.exe 4036 spoolsv.exe 4020 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exef55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exeexplorer.exeexplorer.exedescription pid process target process PID 1084 wrote to memory of 1576 1084 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe PID 1084 wrote to memory of 1576 1084 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe PID 1084 wrote to memory of 1576 1084 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe PID 1084 wrote to memory of 1576 1084 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe PID 1084 wrote to memory of 1576 1084 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe PID 1084 wrote to memory of 1576 1084 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe PID 1084 wrote to memory of 1576 1084 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe PID 1084 wrote to memory of 1576 1084 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe PID 1084 wrote to memory of 1576 1084 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe PID 1084 wrote to memory of 1532 1084 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe diskperf.exe PID 1084 wrote to memory of 1532 1084 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe diskperf.exe PID 1084 wrote to memory of 1532 1084 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe diskperf.exe PID 1084 wrote to memory of 1532 1084 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe diskperf.exe PID 1084 wrote to memory of 1532 1084 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe diskperf.exe PID 1084 wrote to memory of 1532 1084 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe diskperf.exe PID 1576 wrote to memory of 768 1576 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe explorer.exe PID 1576 wrote to memory of 768 1576 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe explorer.exe PID 1576 wrote to memory of 768 1576 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe explorer.exe PID 1576 wrote to memory of 768 1576 f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe explorer.exe PID 768 wrote to memory of 1348 768 explorer.exe explorer.exe PID 768 wrote to memory of 1348 768 explorer.exe explorer.exe PID 768 wrote to memory of 1348 768 explorer.exe explorer.exe PID 768 wrote to memory of 1348 768 explorer.exe explorer.exe PID 768 wrote to memory of 1348 768 explorer.exe explorer.exe PID 768 wrote to memory of 1348 768 explorer.exe explorer.exe PID 768 wrote to memory of 1348 768 explorer.exe explorer.exe PID 768 wrote to memory of 1348 768 explorer.exe explorer.exe PID 768 wrote to memory of 1348 768 explorer.exe explorer.exe PID 768 wrote to memory of 1472 768 explorer.exe diskperf.exe PID 768 wrote to memory of 1472 768 explorer.exe diskperf.exe PID 768 wrote to memory of 1472 768 explorer.exe diskperf.exe PID 768 wrote to memory of 1472 768 explorer.exe diskperf.exe PID 768 wrote to memory of 1472 768 explorer.exe diskperf.exe PID 768 wrote to memory of 1472 768 explorer.exe diskperf.exe PID 1348 wrote to memory of 1052 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 1052 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 1052 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 1052 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 1964 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 1964 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 1964 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 1964 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 956 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 956 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 956 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 956 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 800 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 800 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 800 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 800 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 1612 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 1612 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 1612 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 1612 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 532 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 532 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 532 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 532 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 2008 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 2008 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 2008 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 2008 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 2024 1348 explorer.exe spoolsv.exe PID 1348 wrote to memory of 2024 1348 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe"C:\Users\Admin\AppData\Local\Temp\f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe"C:\Users\Admin\AppData\Local\Temp\f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE6⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe7⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"4⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"2⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Chrome\StikyNot.exeMD5
c5b5e7134d28f77190b35cd98c2779ba
SHA1df6538b2f1527afe8ff473387de959543ba02253
SHA256f55855edf538a97151d3ca12938d3ba8ab517f01c5daeccf4a8e5b1662c40191
SHA5125a6e3dc41a15b658ed849d8ab18ae07b0d650f5263485ce78ae46bc1f81ef893c54bb4da4cf451e7d189e9881de240722e29cff19144e6ac7d6d7cdb6fe418c0
-
C:\Users\Admin\AppData\Local\Temp\Disk.sysMD5
a58e370a3d70a9a55b83d7cdffb2baf3
SHA1f8ce72c540e31debcb5d8625b41819559818047f
SHA256aae5f542756f866264da013392cebaf13a8c4e9b162bebb7c68bacbd379394dd
SHA5128ddcda27959a50c656932f3a5f5b4a1c4b719acf94f6978ce918a71c604a9b0843cf67f16ef6e6b4cdedea5dcf4888f2bab60c687af6dda74f3135d49f5574f6
-
C:\Windows\system\explorer.exeMD5
a58e370a3d70a9a55b83d7cdffb2baf3
SHA1f8ce72c540e31debcb5d8625b41819559818047f
SHA256aae5f542756f866264da013392cebaf13a8c4e9b162bebb7c68bacbd379394dd
SHA5128ddcda27959a50c656932f3a5f5b4a1c4b719acf94f6978ce918a71c604a9b0843cf67f16ef6e6b4cdedea5dcf4888f2bab60c687af6dda74f3135d49f5574f6
-
C:\Windows\system\explorer.exeMD5
a58e370a3d70a9a55b83d7cdffb2baf3
SHA1f8ce72c540e31debcb5d8625b41819559818047f
SHA256aae5f542756f866264da013392cebaf13a8c4e9b162bebb7c68bacbd379394dd
SHA5128ddcda27959a50c656932f3a5f5b4a1c4b719acf94f6978ce918a71c604a9b0843cf67f16ef6e6b4cdedea5dcf4888f2bab60c687af6dda74f3135d49f5574f6
-
C:\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
C:\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
C:\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
C:\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
C:\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
C:\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
C:\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
C:\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
C:\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
C:\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
C:\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
C:\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
C:\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
C:\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
C:\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
C:\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
C:\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
C:\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
C:\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\??\c:\windows\system\explorer.exeMD5
a58e370a3d70a9a55b83d7cdffb2baf3
SHA1f8ce72c540e31debcb5d8625b41819559818047f
SHA256aae5f542756f866264da013392cebaf13a8c4e9b162bebb7c68bacbd379394dd
SHA5128ddcda27959a50c656932f3a5f5b4a1c4b719acf94f6978ce918a71c604a9b0843cf67f16ef6e6b4cdedea5dcf4888f2bab60c687af6dda74f3135d49f5574f6
-
\Windows\system\explorer.exeMD5
a58e370a3d70a9a55b83d7cdffb2baf3
SHA1f8ce72c540e31debcb5d8625b41819559818047f
SHA256aae5f542756f866264da013392cebaf13a8c4e9b162bebb7c68bacbd379394dd
SHA5128ddcda27959a50c656932f3a5f5b4a1c4b719acf94f6978ce918a71c604a9b0843cf67f16ef6e6b4cdedea5dcf4888f2bab60c687af6dda74f3135d49f5574f6
-
\Windows\system\explorer.exeMD5
a58e370a3d70a9a55b83d7cdffb2baf3
SHA1f8ce72c540e31debcb5d8625b41819559818047f
SHA256aae5f542756f866264da013392cebaf13a8c4e9b162bebb7c68bacbd379394dd
SHA5128ddcda27959a50c656932f3a5f5b4a1c4b719acf94f6978ce918a71c604a9b0843cf67f16ef6e6b4cdedea5dcf4888f2bab60c687af6dda74f3135d49f5574f6
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
\Windows\system\spoolsv.exeMD5
ddf7eaf593273b5220209cc4b7d05b2f
SHA1db0ff9246a8324da68b7ebe0c12c157913571594
SHA256178186c1d36da93816b98bb6699f26ac06609e6b0112268c9894c75e046c3129
SHA5120b00582547712e2ccc3b588c199c22ff5d140db3b2d0100de9a287f86b78900d7187c2de7262012a4739c9072135376619159794470ad48c4384412971aa2818
-
memory/272-239-0x0000000000000000-mapping.dmp
-
memory/272-251-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/284-266-0x0000000000000000-mapping.dmp
-
memory/284-276-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/432-253-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/432-243-0x0000000000000000-mapping.dmp
-
memory/532-134-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/532-125-0x0000000000000000-mapping.dmp
-
memory/536-252-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/536-241-0x0000000000000000-mapping.dmp
-
memory/672-206-0x0000000000000000-mapping.dmp
-
memory/728-174-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/728-167-0x0000000000000000-mapping.dmp
-
memory/752-159-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/752-155-0x0000000000000000-mapping.dmp
-
memory/768-73-0x0000000000000000-mapping.dmp
-
memory/768-78-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/768-302-0x0000000000000000-mapping.dmp
-
memory/788-315-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/788-311-0x0000000000000000-mapping.dmp
-
memory/800-113-0x0000000000000000-mapping.dmp
-
memory/800-118-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/840-220-0x0000000000000000-mapping.dmp
-
memory/840-231-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/948-237-0x0000000000000000-mapping.dmp
-
memory/948-250-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/952-235-0x0000000000000000-mapping.dmp
-
memory/956-107-0x0000000000000000-mapping.dmp
-
memory/956-117-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/968-289-0x0000000000000000-mapping.dmp
-
memory/1052-96-0x0000000000000000-mapping.dmp
-
memory/1068-309-0x0000000000000000-mapping.dmp
-
memory/1068-313-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1084-61-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1084-60-0x00000000752F1000-0x00000000752F3000-memory.dmpFilesize
8KB
-
memory/1100-232-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1100-222-0x0000000000000000-mapping.dmp
-
memory/1136-258-0x0000000000000000-mapping.dmp
-
memory/1136-270-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1172-304-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1172-298-0x0000000000000000-mapping.dmp
-
memory/1176-203-0x0000000000000000-mapping.dmp
-
memory/1176-211-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1184-274-0x00000000002E0000-0x00000000002E1000-memory.dmpFilesize
4KB
-
memory/1184-268-0x0000000000000000-mapping.dmp
-
memory/1196-228-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1196-214-0x0000000000000000-mapping.dmp
-
memory/1216-273-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1216-262-0x0000000000000000-mapping.dmp
-
memory/1256-281-0x0000000000000000-mapping.dmp
-
memory/1256-293-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1276-287-0x0000000000000000-mapping.dmp
-
memory/1348-81-0x0000000000403670-mapping.dmp
-
memory/1368-300-0x0000000000000000-mapping.dmp
-
memory/1368-306-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1472-86-0x0000000000411000-mapping.dmp
-
memory/1476-254-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/1476-245-0x0000000000000000-mapping.dmp
-
memory/1524-269-0x0000000000360000-0x0000000000361000-memory.dmpFilesize
4KB
-
memory/1524-256-0x0000000000000000-mapping.dmp
-
memory/1532-77-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1532-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1532-67-0x0000000000411000-mapping.dmp
-
memory/1536-301-0x0000000000000000-mapping.dmp
-
memory/1540-191-0x0000000000000000-mapping.dmp
-
memory/1540-198-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1544-162-0x0000000000000000-mapping.dmp
-
memory/1556-297-0x0000000000000000-mapping.dmp
-
memory/1560-260-0x0000000000000000-mapping.dmp
-
memory/1568-173-0x0000000000000000-mapping.dmp
-
memory/1576-76-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1576-62-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1576-63-0x0000000000403670-mapping.dmp
-
memory/1596-292-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1596-279-0x0000000000000000-mapping.dmp
-
memory/1612-133-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1612-120-0x0000000000000000-mapping.dmp
-
memory/1632-224-0x0000000000000000-mapping.dmp
-
memory/1632-233-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1636-285-0x0000000000000000-mapping.dmp
-
memory/1640-158-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1640-150-0x0000000000000000-mapping.dmp
-
memory/1648-277-0x0000000000000000-mapping.dmp
-
memory/1660-179-0x0000000000000000-mapping.dmp
-
memory/1660-186-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1668-283-0x0000000000000000-mapping.dmp
-
memory/1680-147-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1680-143-0x0000000000000000-mapping.dmp
-
memory/1688-213-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1688-208-0x0000000000000000-mapping.dmp
-
memory/1704-229-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1704-216-0x0000000000000000-mapping.dmp
-
memory/1752-310-0x0000000000000000-mapping.dmp
-
memory/1824-247-0x0000000000000000-mapping.dmp
-
memory/1852-312-0x0000000000000000-mapping.dmp
-
memory/1912-196-0x0000000000000000-mapping.dmp
-
memory/1912-210-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1924-197-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1924-185-0x0000000000000000-mapping.dmp
-
memory/1932-264-0x0000000000000000-mapping.dmp
-
memory/1948-299-0x0000000000000000-mapping.dmp
-
memory/1948-305-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1964-108-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1964-101-0x0000000000000000-mapping.dmp
-
memory/2000-226-0x0000000000000000-mapping.dmp
-
memory/2000-234-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2008-130-0x0000000000000000-mapping.dmp
-
memory/2008-135-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2012-230-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2012-218-0x0000000000000000-mapping.dmp
-
memory/2024-146-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2024-138-0x0000000000000000-mapping.dmp