warzonerat | 5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167

Analysis

max time kernel
133s
max time network
8s
platform
windows7_x64
resource
win7v20210410
submitted
04-05-2021 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe
Size

1.8MB
MD5

d6de6a5681c7cf2d282efd99c9e0086b
SHA1

ba5fa98776517acf378d9c0fe4c22d821c47ffc3
SHA256

5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167
SHA512

d8784ff2a22bee67413f2f4eeaffd33f39e9be8ca05d24d49b5736f684d0fab57ebe86c488454fc1ecc1286128dc7559b6a9b570fdd886a5376bb61d85e9a780

Score

10^/10

warzonerat evasion infostealer persistence rat

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs
evasion

Hidden Files and Directories
T1158

Modify Registry
T1112
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 64 IoCs

rat

Processes:

resource	yara_rule
\Windows\system\explorer.exe	warzonerat
\Windows\system\explorer.exe	warzonerat
C:\Windows\system\explorer.exe	warzonerat
\??\c:\windows\system\explorer.exe	warzonerat
C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe	warzonerat
C:\Users\Admin\AppData\Local\Temp\Disk.sys	warzonerat
C:\Windows\system\explorer.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
C:\Windows\system\spoolsv.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat

Executes dropped EXE 64 IoCs

Processes:

explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

pid	process
764	explorer.exe
572	explorer.exe
668	spoolsv.exe
1836	spoolsv.exe
344	spoolsv.exe
1668	spoolsv.exe
324	spoolsv.exe
1736	spoolsv.exe
1472	spoolsv.exe
1992	spoolsv.exe
1996	spoolsv.exe
800	spoolsv.exe
1164	spoolsv.exe
1124	spoolsv.exe
1952	spoolsv.exe
1492	spoolsv.exe
1564	spoolsv.exe
1120	spoolsv.exe
1552	spoolsv.exe
748	spoolsv.exe
320	spoolsv.exe
568	spoolsv.exe
1628	spoolsv.exe
1728	spoolsv.exe
1212	spoolsv.exe
608	spoolsv.exe
1724	spoolsv.exe
292	spoolsv.exe
1760	spoolsv.exe
836	spoolsv.exe
1620	spoolsv.exe
1108	spoolsv.exe
1168	spoolsv.exe
2020	spoolsv.exe
1352	spoolsv.exe
1008	spoolsv.exe
940	spoolsv.exe
1172	spoolsv.exe
1100	spoolsv.exe
1684	spoolsv.exe
1704	spoolsv.exe
1964	spoolsv.exe
2040	spoolsv.exe
1912	spoolsv.exe
1480	spoolsv.exe
632	spoolsv.exe
896	spoolsv.exe
956	spoolsv.exe
1104	spoolsv.exe
1388	spoolsv.exe
848	spoolsv.exe
2004	spoolsv.exe
616	spoolsv.exe
968	spoolsv.exe
948	spoolsv.exe
1696	spoolsv.exe
1300	spoolsv.exe
1528	spoolsv.exe
1580	spoolsv.exe
1140	spoolsv.exe
1380	spoolsv.exe
1676	spoolsv.exe
1904	spoolsv.exe
332	spoolsv.exe

Modifies Installed Components in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Loads dropped DLL 64 IoCs

Processes:

5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exeexplorer.exe

pid	process
1704	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe
1704	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\SyncHost.exe"	spoolsv.exe

Suspicious use of SetThreadContext 12 IoCs

Processes:

5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

description	pid	process	target process
PID 1420 set thread context of 1704	1420	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe
PID 1420 set thread context of 1708	1420	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	diskperf.exe
PID 764 set thread context of 572	764	explorer.exe	explorer.exe
PID 764 set thread context of 340	764	explorer.exe	diskperf.exe
PID 668 set thread context of 2944	668	spoolsv.exe	spoolsv.exe
PID 668 set thread context of 2952	668	spoolsv.exe	diskperf.exe
PID 1836 set thread context of 2992	1836	spoolsv.exe	spoolsv.exe
PID 1836 set thread context of 3012	1836	spoolsv.exe	diskperf.exe
PID 344 set thread context of 3028	344	spoolsv.exe	spoolsv.exe
PID 344 set thread context of 3036	344	spoolsv.exe	diskperf.exe
PID 1668 set thread context of 3064	1668	spoolsv.exe	spoolsv.exe
PID 1668 set thread context of 1812	1668	spoolsv.exe	diskperf.exe

Drops file in Windows directory 4 IoCs

Processes:

5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exeexplorer.exespoolsv.exe

description	ioc	process
File opened for modification	\??\c:\windows\system\explorer.exe	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exeexplorer.exe

pid	process
1704	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

572 explorer.exe

pid	process
572	explorer.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

pid	process
1704	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe
1704	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
572	explorer.exe
2944	spoolsv.exe
2944	spoolsv.exe
2992	spoolsv.exe
2992	spoolsv.exe
3028	spoolsv.exe
3028	spoolsv.exe
3064	spoolsv.exe
3064	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exeexplorer.exeexplorer.exe

description	pid	process	target process
PID 1420 wrote to memory of 1704	1420	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe
PID 1420 wrote to memory of 1704	1420	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe
PID 1420 wrote to memory of 1704	1420	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe
PID 1420 wrote to memory of 1704	1420	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe
PID 1420 wrote to memory of 1704	1420	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe
PID 1420 wrote to memory of 1704	1420	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe
PID 1420 wrote to memory of 1704	1420	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe
PID 1420 wrote to memory of 1704	1420	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe
PID 1420 wrote to memory of 1704	1420	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe
PID 1420 wrote to memory of 1708	1420	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	diskperf.exe
PID 1420 wrote to memory of 1708	1420	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	diskperf.exe
PID 1420 wrote to memory of 1708	1420	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	diskperf.exe
PID 1420 wrote to memory of 1708	1420	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	diskperf.exe
PID 1420 wrote to memory of 1708	1420	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	diskperf.exe
PID 1420 wrote to memory of 1708	1420	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	diskperf.exe
PID 1704 wrote to memory of 764	1704	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	explorer.exe
PID 1704 wrote to memory of 764	1704	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	explorer.exe
PID 1704 wrote to memory of 764	1704	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	explorer.exe
PID 1704 wrote to memory of 764	1704	5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe	explorer.exe
PID 764 wrote to memory of 572	764	explorer.exe	explorer.exe
PID 764 wrote to memory of 572	764	explorer.exe	explorer.exe
PID 764 wrote to memory of 572	764	explorer.exe	explorer.exe
PID 764 wrote to memory of 572	764	explorer.exe	explorer.exe
PID 764 wrote to memory of 572	764	explorer.exe	explorer.exe
PID 764 wrote to memory of 572	764	explorer.exe	explorer.exe
PID 764 wrote to memory of 572	764	explorer.exe	explorer.exe
PID 764 wrote to memory of 572	764	explorer.exe	explorer.exe
PID 764 wrote to memory of 572	764	explorer.exe	explorer.exe
PID 764 wrote to memory of 340	764	explorer.exe	diskperf.exe
PID 764 wrote to memory of 340	764	explorer.exe	diskperf.exe
PID 764 wrote to memory of 340	764	explorer.exe	diskperf.exe
PID 764 wrote to memory of 340	764	explorer.exe	diskperf.exe
PID 764 wrote to memory of 340	764	explorer.exe	diskperf.exe
PID 764 wrote to memory of 340	764	explorer.exe	diskperf.exe
PID 572 wrote to memory of 668	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 668	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 668	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 668	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 1836	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 1836	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 1836	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 1836	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 344	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 344	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 344	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 344	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 1668	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 1668	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 1668	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 1668	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 324	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 324	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 324	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 324	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 1736	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 1736	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 1736	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 1736	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 1472	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 1472	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 1472	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 1472	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 1992	572	explorer.exe	spoolsv.exe
PID 572 wrote to memory of 1992	572	explorer.exe	spoolsv.exe

C:\Users\Admin\AppData\Local\Temp\5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe
"C:\Users\Admin\AppData\Local\Temp\5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Users\Admin\AppData\Local\Temp\5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe
  "C:\Users\Admin\AppData\Local\Temp\5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1704
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:764
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:668
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2944
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:2984
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:2952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1836
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2992
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:3004
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:344
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3028
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:3056
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1668
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3064
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:1768
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:1812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:324
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:2972
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:3024
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:2964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1736
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3052
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1472
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3068
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1992
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:2968
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:3068
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:1924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1996
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:1980
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:3076
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:1612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:800
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3092
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:3112
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1164
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3148
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1124
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3120
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:3140
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3128
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1952
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3168
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3176
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1492
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3184
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:3204
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1564
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3220
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1120
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3228
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:3256
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3236
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1552
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3264
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:3288
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:748
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3296
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:3316
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:320
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3332
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:3352
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:568
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3364
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:3388
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1628
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3396
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:3416
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1728
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3424
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1212
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3440
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:3460
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:608
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3468
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:3488
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1724
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3504
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:3556
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:292
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3496
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1760
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3544
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:836
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3528
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1620
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3596
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1108
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3604
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1168
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3588
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2020
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3656
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1352
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3648
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1008
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3664
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:940
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3700
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1172
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3676
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1100
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3732
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1684
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3692
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3716
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1704
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3756
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1964
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3788
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2040
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3796
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1912
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3804
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1480
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3820
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:632
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3828
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:896
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3912
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:3976
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:956
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3852
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1104
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3860
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1388
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3868
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:848
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3904
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:4000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2004
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3876
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:616
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3920
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:4008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:968
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3984
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:4068
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:4076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:948
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3944
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:4024
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:4032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1696
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3960
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:4060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1300
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3952
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:4044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1528
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3088
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1580
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:1316
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1380
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:3108
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1676
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:4092
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1904
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        6⤵
        
        PID:4084
        
        \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        7⤵
        
        PID:1944
      - C:\Windows\SysWOW64\diskperf.exe
        
        "C:\Windows\SysWOW64\diskperf.exe"
        6⤵
        
        PID:3124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2156
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2172
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2204
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2236
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2268
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2784
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2888
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2976
  - - C:\Windows\SysWOW64\diskperf.exe
      "C:\Windows\SysWOW64\diskperf.exe"
      4⤵
      PID:340
- C:\Windows\SysWOW64\diskperf.exe
  "C:\Windows\SysWOW64\diskperf.exe"
  2⤵
  PID:1708

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
PID:532

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
PID:3632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

MD5
d6de6a5681c7cf2d282efd99c9e0086b

SHA1
ba5fa98776517acf378d9c0fe4c22d821c47ffc3

SHA256
5d3de3a4a8cc6e62349bdfe5b00bb7afa50329cf68bed52e110735da4e373167

SHA512
d8784ff2a22bee67413f2f4eeaffd33f39e9be8ca05d24d49b5736f684d0fab57ebe86c488454fc1ecc1286128dc7559b6a9b570fdd886a5376bb61d85e9a780

Download Submit
C:\Users\Admin\AppData\Local\Temp\Disk.sys

MD5
5f28b5184c611c5e913616f6c5fc94b1

SHA1
2db31f001a7c565af1f60df669e2d7ed140ccbfd

SHA256
42f56d22c399a95d7cb502f71bef7fa76457ebfd6fd06b08c9dbd6e5ad8b7aba

SHA512
0ccf8b02afa2bfbf0bd4698440cc6c2cc0e341c5f538ff0dc81a8c276fafb16ad0ea9dc79ed5d45aa0b6cc2b98ae07475543a7284615dbdf2658e5f9eb192264

Download Submit
C:\Windows\system\explorer.exe

MD5
5f28b5184c611c5e913616f6c5fc94b1

SHA1
2db31f001a7c565af1f60df669e2d7ed140ccbfd

SHA256
42f56d22c399a95d7cb502f71bef7fa76457ebfd6fd06b08c9dbd6e5ad8b7aba

SHA512
0ccf8b02afa2bfbf0bd4698440cc6c2cc0e341c5f538ff0dc81a8c276fafb16ad0ea9dc79ed5d45aa0b6cc2b98ae07475543a7284615dbdf2658e5f9eb192264

Download Submit
C:\Windows\system\explorer.exe

MD5
5f28b5184c611c5e913616f6c5fc94b1

SHA1
2db31f001a7c565af1f60df669e2d7ed140ccbfd

SHA256
42f56d22c399a95d7cb502f71bef7fa76457ebfd6fd06b08c9dbd6e5ad8b7aba

SHA512
0ccf8b02afa2bfbf0bd4698440cc6c2cc0e341c5f538ff0dc81a8c276fafb16ad0ea9dc79ed5d45aa0b6cc2b98ae07475543a7284615dbdf2658e5f9eb192264

Download Submit
C:\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
C:\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
C:\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
C:\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
C:\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
C:\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
C:\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
C:\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
C:\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
C:\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
C:\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
C:\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
C:\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
C:\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
C:\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
C:\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
C:\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
C:\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
C:\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\??\c:\windows\system\explorer.exe

MD5
5f28b5184c611c5e913616f6c5fc94b1

SHA1
2db31f001a7c565af1f60df669e2d7ed140ccbfd

SHA256
42f56d22c399a95d7cb502f71bef7fa76457ebfd6fd06b08c9dbd6e5ad8b7aba

SHA512
0ccf8b02afa2bfbf0bd4698440cc6c2cc0e341c5f538ff0dc81a8c276fafb16ad0ea9dc79ed5d45aa0b6cc2b98ae07475543a7284615dbdf2658e5f9eb192264

Download Submit
\Windows\system\explorer.exe

MD5
5f28b5184c611c5e913616f6c5fc94b1

SHA1
2db31f001a7c565af1f60df669e2d7ed140ccbfd

SHA256
42f56d22c399a95d7cb502f71bef7fa76457ebfd6fd06b08c9dbd6e5ad8b7aba

SHA512
0ccf8b02afa2bfbf0bd4698440cc6c2cc0e341c5f538ff0dc81a8c276fafb16ad0ea9dc79ed5d45aa0b6cc2b98ae07475543a7284615dbdf2658e5f9eb192264

Download Submit
\Windows\system\explorer.exe

MD5
5f28b5184c611c5e913616f6c5fc94b1

SHA1
2db31f001a7c565af1f60df669e2d7ed140ccbfd

SHA256
42f56d22c399a95d7cb502f71bef7fa76457ebfd6fd06b08c9dbd6e5ad8b7aba

SHA512
0ccf8b02afa2bfbf0bd4698440cc6c2cc0e341c5f538ff0dc81a8c276fafb16ad0ea9dc79ed5d45aa0b6cc2b98ae07475543a7284615dbdf2658e5f9eb192264

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
\Windows\system\spoolsv.exe

MD5
f97561fb7670993f12dd4932c29ce7a5

SHA1
f2aba08d695ec2147aae70ca29caacc013d99524

SHA256
e45fec529938702b31820e7e56827c2bc3c22a9cfa1fb54d5d6acdfb118488a0

SHA512
3d802fad728eba0a27391829b7f2d749e97df904455c86f22105689f82d1b8613f7364440fc60edd93c2567b7995eaf7b519cf850bc343a793eb86b7f692c14b

Download Submit
memory/292-222-0x0000000000000000-mapping.dmp

Download
memory/320-202-0x0000000000000000-mapping.dmp

Download
memory/320-206-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/324-136-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/324-117-0x0000000000000000-mapping.dmp

Download
memory/340-86-0x0000000000411000-mapping.dmp

Download
memory/344-106-0x0000000000000000-mapping.dmp

Download
memory/344-118-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/568-213-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/568-207-0x0000000000000000-mapping.dmp

Download
memory/572-80-0x0000000000403670-mapping.dmp

Download
memory/608-218-0x0000000000000000-mapping.dmp

Download
memory/616-301-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/616-295-0x0000000000000000-mapping.dmp

Download
memory/632-276-0x0000000000000000-mapping.dmp

Download
memory/668-98-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/668-94-0x0000000000000000-mapping.dmp

Download
memory/748-205-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/748-197-0x0000000000000000-mapping.dmp

Download
memory/764-74-0x0000000000000000-mapping.dmp

Download
memory/764-77-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/800-158-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/800-148-0x0000000000000000-mapping.dmp

Download
memory/836-231-0x0000000000000000-mapping.dmp

Download
memory/836-245-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/848-293-0x0000000000000000-mapping.dmp

Download
memory/896-288-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/896-278-0x0000000000000000-mapping.dmp

Download
memory/940-264-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/940-252-0x0000000000000000-mapping.dmp

Download
memory/948-303-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/948-297-0x0000000000000000-mapping.dmp

Download
memory/956-280-0x0000000000000000-mapping.dmp

Download
memory/956-289-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/968-296-0x0000000000000000-mapping.dmp

Download
memory/1008-243-0x0000000000000000-mapping.dmp

Download
memory/1008-251-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1100-256-0x0000000000000000-mapping.dmp

Download
memory/1104-290-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1104-282-0x0000000000000000-mapping.dmp

Download
memory/1108-235-0x0000000000000000-mapping.dmp

Download
memory/1120-193-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1120-184-0x0000000000000000-mapping.dmp

Download
memory/1124-161-0x0000000000000000-mapping.dmp

Download
memory/1124-174-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1140-314-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/1140-308-0x0000000000000000-mapping.dmp

Download
memory/1164-153-0x0000000000000000-mapping.dmp

Download
memory/1164-157-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1168-237-0x0000000000000000-mapping.dmp

Download
memory/1172-265-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1172-254-0x0000000000000000-mapping.dmp

Download
memory/1212-226-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1212-216-0x0000000000000000-mapping.dmp

Download
memory/1300-305-0x0000000000000000-mapping.dmp

Download
memory/1352-241-0x0000000000000000-mapping.dmp

Download
memory/1352-250-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1380-309-0x0000000000000000-mapping.dmp

Download
memory/1388-291-0x0000000000000000-mapping.dmp

Download
memory/1420-59-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

Filesize
8KB

Download
memory/1420-60-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1472-129-0x0000000000000000-mapping.dmp

Download
memory/1472-140-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1480-274-0x0000000000000000-mapping.dmp

Download
memory/1480-286-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1492-176-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1492-171-0x0000000000000000-mapping.dmp

Download
memory/1528-312-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1528-306-0x0000000000000000-mapping.dmp

Download
memory/1552-189-0x0000000000000000-mapping.dmp

Download
memory/1564-192-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1564-179-0x0000000000000000-mapping.dmp

Download
memory/1580-307-0x0000000000000000-mapping.dmp

Download
memory/1620-233-0x0000000000000000-mapping.dmp

Download
memory/1628-209-0x0000000000000000-mapping.dmp

Download
memory/1668-119-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1668-111-0x0000000000000000-mapping.dmp

Download
memory/1684-258-0x0000000000000000-mapping.dmp

Download
memory/1696-304-0x0000000000000000-mapping.dmp

Download
memory/1704-260-0x0000000000000000-mapping.dmp

Download
memory/1704-268-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1704-70-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1704-61-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1704-62-0x0000000000403670-mapping.dmp

Download
memory/1708-71-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1708-65-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1708-66-0x0000000000411000-mapping.dmp

Download
memory/1724-220-0x0000000000000000-mapping.dmp

Download
memory/1724-229-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1728-215-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1728-211-0x0000000000000000-mapping.dmp

Download
memory/1736-124-0x0000000000000000-mapping.dmp

Download
memory/1760-224-0x0000000000000000-mapping.dmp

Download
memory/1836-101-0x0000000000000000-mapping.dmp

Download
memory/1836-114-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1912-272-0x0000000000000000-mapping.dmp

Download
memory/1952-175-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1952-166-0x0000000000000000-mapping.dmp

Download
memory/1964-262-0x0000000000000000-mapping.dmp

Download
memory/1964-269-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1992-134-0x0000000000000000-mapping.dmp

Download
memory/1992-139-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1996-156-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1996-143-0x0000000000000000-mapping.dmp

Download
memory/2004-300-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2004-294-0x0000000000000000-mapping.dmp

Download
memory/2020-239-0x0000000000000000-mapping.dmp

Download
memory/2040-270-0x0000000000000000-mapping.dmp

Download